Custom TOTP authenticator

Using this method, admins can configure any TOTP authenticator for identity verification. ADSelfService Plus supports two types of TOTP tokens for authentication:

• Software TOTP token: Mobile or desktop applications that generate a time-based OTP based on the secret key provided by ADSelfService Plus during enrollment. These tokens can either be enrolled by the user through self-enrollment or by the admin through bulk enrollment.
• Hardware TOTP token: Hardware devices that generate a time-based OTP based on the secret key burned into the hardware device. These tokens can be enrolled only by the admin through bulk enrollment with the help of a seed file (file consisting of secret keys for the respective hardware devices provided by hardware vendors).

Steps to configure custom TOTP authenticators

1. Navigate to Configuration → Self-Service → Multi-factor Authentication → Authenticators Setup.
2. From the Choose the Policy drop-down, select a policy.
Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy.
3. Click Custom TOTP Authenticator section.
4. Enter the Authenticator Name, Passcode Length, Passcode Expiration Time, Passcode Hashing Algorithm, Account Name Format and upload the Authenticator Logo.
Note:If the Authenticator Logo is not uploaded, a default logo will be used.
5. Choose either Software Token or Hardware Token based on the type of token you wish to configure.
Note: Custom TOTP Hardware Token Authenticator is an Advanced Authenticator available as part of the Professional Edition of ADSelfService Plus.
6. Click Save.

How to enroll for custom TOTP authenticators

1. Software tokens can be enrolled either by the user through self-enrollment or by admins through bulk enrollment (importing data via a CSV file or by fetching data from an external database).
2. You can enroll for hardware tokens using two methods:
   • By importing data via a CSV file
   • By fetching data from an external database

To modify the configuration:

1. Navigate to Configuration → Self-Service → Multi-factor Authentication → Authenticators Setup.
2. Click Custom TOTP Authenticator section.
3. Click Modify and change the information provided wherever necessary.
4. If the configuration has to be removed, click Remove Configuration.
5. Click Save.