PingOne Advanced Identity Cloud

One-time passcode (TOTP) settings

Time-based one-time passcode (TOTP) settings control how Advanced Identity Cloud stores and protects the device metadata registered by users of OATH-based authenticator apps.

These settings are available by default. In most cases you don’t need to change them to get started, but for production environments you should select an encryption scheme and store the associated key in an ESV secret.

In the admin console, this authentication method is labeled One-time Passcode (TOTP). The underlying OATH-based authentication flow supports both TOTP and HOTP, but TOTP is the default configuration.

Learn more about configuring journeys that authenticate end users with OATH-based authentication in MFA: Use codes from an authenticator app using OATH.

Configure one-time passcode (TOTP) settings

  1. In the Advanced Identity Cloud admin console, go to verified_user Authentication > Authentication Methods.

  2. Click One-time Passcode (TOTP).

  3. If one-time passcode (TOTP) is not already enabled, click Enable One-time Passcode (TOTP) to create it with default settings before configuring it.

  4. Configure the following settings:

    Profile Storage Attribute

    Attribute for storing ForgeRock Authenticator OATH profiles.

    Device Profile Encryption Scheme

    Encryption scheme to use to secure device profiles stored on the server.

    If enabled, each device profile is encrypted using a unique random secret key using the given strength of AES encryption in CBC mode with PKCS#5 padding. An HMAC-SHA of the given strength (truncated to half-size) is used to ensure integrity protection and authenticated encryption. The unique random key is encrypted with the given RSA key pair and stored with the data.

    The possible values for this property are:

    • AES-256/HMAC-SHA-512 with RSA Key Wrapping

    • AES-128/HMAC-SHA-256 with RSA Key Wrapping

    • No encryption of device settings.

    Default value: No encryption of device settings.

    Encryption Key Store

    Path to the key store from which to load encryption keys.

    Updating this setting isn’t currently supported in Advanced Identity Cloud. Changing its value may lead to a loss of functionality in this feature.

    For greater security, store encryption key information in ESVs, instead of in the configuration. Use the secret label am.services.authenticatoroath.encryption to map an alias for ForgeRock Authenticator (OATH) secrets.

    If you update encryption key information, end users with existing device profiles won’t be able to sign on using an authenticator app. Delete the end user’s device profile so that they can create a new one when they next sign on.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatoroath.encryption label in the realm’s ESV secret store, this value is ignored.
    Key Store Type

    Type of key store to load.

    This property is preconfigured in your Advanced Identity Cloud tenant and shouldn’t be altered.

    Default value: Java Cryptography Extension Key Store (JCEKS)

    Key Store Password

    Password to unlock the key store. This password will be encrypted.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatoroath.encryption label in the realm’s ESV secret store, this value is ignored.
    Key-Pair Alias

    Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatoroath.encryption label in the realm’s ESV secret store, this value is ignored.
    Private Key Password

    Password to unlock the private key.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatoroath.encryption label in the realm’s ESV secret store, this value is ignored.
    ForgeRock Authenticator (OATH) Device Skippable Attribute Name

    The data store attribute that holds the user’s decision to enable or disable obtaining and providing a password obtained from an authenticator app. This attribute must be writeable.

  5. Click Save.