How to configure Time-based One Time Password (TOTP) in SMA 1000 series?

07/28/2020 60 11271

DESCRIPTION:

SMA 1000 series supports TOTP starting from firmware 12.2.0. Appliance can generate OTP and send via email (requires SMTP configuration) or generate TOTP via mobile App like Google Authenticator and Microsoft Authenticator. In this article, we will see how to configure TOTP in appliance and the user login flow.

CAUSE:

TOTP (Time-based One Time Password) is generated by an algorithm, which uses current time of day as one of its factor to ensure that each OTP is unique. The Time-Based One-Time Password (TOTP) is an alternative method of Two-Factor Authentication which can be more cost-effective when compared to traditional Two-Factor Authentication technologies.

RESOLUTION:

Pre-requisite:

As TOTP is time senstivie algorithm, make sure NTP is configured and appliance date/time is in sync to avoid OTP mismatch errors.

Steps to configure TOTP:

1. Configure TOTP General Settings: Login to AMC, navigate to Authentication Servers. Under Other servers, Click Edit next to Configure time-based one-time password (TOTP) settings.

Enable "Enable time-based one-time password" and click Save. Time difference, Lock account after failed attempts, Automatically unlock account can be configured as per your requirement.

 To know about how to manage TOTP users, Check How to manage TOTP users in SMA 1000.

2. Enable TOTP in the Authentication Server: Edit the respective Authentication Server for which you need TOTP and expand Advanced.

Under One-Time Passwords section,

Enable "Use one-time passwords with this authentication server".

Enable "Use the configured TOTP service. Passwords will be generated by the user on an app".

"Service name:" Configure a name for identification in the app. This name will be displayed in the app along with the account name.

Enable "Allow user to deregister account" if you would like to allow users to de-register their TOTP account themselves from Wokrplace.

Enable "Use back-up codes" if you would like to provide back-up codes in case if user does not have access to their phone to generate TOTP.

 You can also allow the registration of users only from specific trusted networks. Click + icon and add the networks. If nothing is added, registration will be allowed from any network.

3. Navigate to Realms and assign the Authentication Server to the respective Realm for which TOTP is needed. Apply Pending changes.

How to register the user for TOTP login:

Scenario 1: User logins to Workplace for first time after TOTP is configured

Post entering the user credentials, user clicks Log in from Workplace, they will be presented with below screen:

Open the App (TOTP Apps like Google Authenticator or Microsoft Authenticator), Select Add new account and scan the QR code shown in Workplace or select Manual entry and enter the Secret key shown above the QR code Once scanned, TOTP will be generated in the App. Enter the TOTP in the "Enter the 6 digit code generated by the One Time Password app" textbox and Click Ok.

If Backup codes is enabled, the backup codes available to the user is shown. The user can copy the backup codes and keep it safe. They can use backup code to login in case if they do not have access to app to generate TOTP. Clicking Ok will log you in now.

Back-up codes can be found again only when you are logged into workplace, under Details. It is advised to copy the backup codes now and keep it safe.

 Back-up codes can be renewed only once in 24 hours from Workplace under Details.

Back-up codes are one-time use codes and you will find only the unused codes under Details.

Any subsequent logins from Workplace / Connect Tunnel / Mobile Connect, the user will be prompted to enter the 6-digit TOTP from app / back-up code.

Subsequent login from Workplace:

Subsequent login from Connect Tunnel:

Scenario 2: User logins to Connect Tunnel for first time after TOTP is configured

User can add account in app either by scanning QR code shown in Connect Tunnel or by choosing Manual enter and entering Secret Key shown in the Connect Tunnel.

For troubleshooting Invalid TOTP code errors, Check TOTP Authentication Failure - Invalid Password for Two-Factor Authentication using Google / Microsoft 2FA.