Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is TOTP?
Short answer
TOTP (Time-based One-Time Password) is the OTP method that generates a new code at fixed periods (mostly 30 seconds) from a secret shared by the user's device and the server and from the current time (RFC 6238). Applications such as Google Authenticator and Microsoft Authenticator work with this method; since the code is generated on the device, no sending channel is required, but the clocks of the device and the server must be correct. In TR7 AGS, TOTP is selected as the MFA Method in the Multi-Factor Authentication (MFA) profile: when the user first comes to the MFA step, the user registers the authenticator application with the QR code (by entering the secret manually if Allow Manual Entry is on), and at later logins types the code in the application. In the profile, TOTP Algorithm (default SHA1), TOTP Digits (6 or 8, default 6), TOTP Period (15–60 seconds, default 30), TOTP Window (0–10 steps, default 1) and TOTP Issuer Name are set. The users' registrations are monitored and reset on the TOTP tab of the AGS-enabled vService.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Multi-Factor Authentication (MFA) | MFA Method = TOTP; TOTP Algorithm (SHA1 / SHA256 / SHA512), TOTP Digits, TOTP Period, TOTP Window | Code generation and verification parameters |
| Same form | TOTP Issuer Name (default %REQHEADER(host)), Allow Manual Entry, Allow Backup Codes (both on by default), Trust Device | The account name shown in the application, the registration method, the backup codes and the trusted device |
| AGS-enabled vService → Flowchart | MFA Profile: the built-in TOTP Standard and TOTP Strict profiles | Selecting the built-in TOTP profiles in the flow |
| AGS-enabled vService → TOTP tab | User ID, Username, E-mail, Enrolled At, Backup Codes; Reset TOTP | Monitoring the registered users and the remaining backup codes; resetting the registration of a user who has lost the phone |
| AGS-enabled vService → Dashboard | AGS TOTP chart | The numbers of TOTP codes shown, answered, correct and incorrect per second |
Built-in TOTP Profiles
| Profile | Algorithm | Digits | Period | Window | Backup codes | Trust device |
|---|---|---|---|---|---|---|
| TOTP Standard | SHA1 | 6 | 30 s | 1 | On | On, 30 days |
| TOTP Strict | SHA256 | 8 | 30 s | 0 | Off | Off |
Common Misconceptions
- "The TOTP code is sent by SMS." The code is generated in the application on the user's device; it is not sent over any channel (What is an OTP (One-Time Password)?).
- "The device clock is unimportant." The code depends on time; if the difference between the device and TR7 exceeds the TOTP Window tolerance, the code is rejected. TR7's clock is synchronized with NTP (What is NTP; why is time synchronization important in TR7?).
- "The registration is valid on all vServices." The TOTP registration is bound not to the MFA profile but to the vService; the user registers separately for each AGS-enabled vService. To reset the registration, the TOTP tab of the relevant vService is used.
How it is done in the documentation
