Two-factor OATH authentication with Google Authenticator

Google Authenticator generates verification code as a dynamic component to a static password to increase account security.

Fudo Enterprise allows configuring default settings for the OATH authentication so they are automatically added to the user definition, when administrator selects OATH as an active authentication method.

Protocols Supporting OATH Authentication Method

When logging in, OATH authentication can be performed either in Challenge-Response mode or by concatenating the dynamic code generated by Google Authenticator to the end of the static password defined in the authentication method, such as password481418. Please note that not all protocols support this authentication method.

OATH Availability Across Protocols

Platform or Protocol	Challenge-Response Mode	Password + Dynamic Code
Logging into Access Gateway	available	available
Logging into Admin Panel	available	available
VNC	available	available
SSH	available	available
RDP	available	available
Telnet 3270	not available	available
Telnet 5250	not available	available
Telnet	not available	available
MS SQL(TDS)	not available	not available
HTTP/S	not available	not available
TCP	not available	not available
MySQL	not available	not available
X11	not available	not available
Modbus	not available	not available

Configuring the OATH Authentication Method

In order to configure default settings for the OATH authentication method, follow the instruction:

1. Select Settings > Authentication > OATH authentication.
2. Fill out the Issuer field.
3. From the Token type field select TOTP (time-base) or HOTP (counter-base).
4. Fill out the Token length field.
5. Input Time step if selected Token type was TOTP (time-base).
6. Click Save.

In order to configure OATH as an active authentication method for a user, follow the steps:

1. Select Management > Users.
2. Find and click the user for whom you want to add the OATH authentication method.
3. Scroll down to the Authentication section.
4. From the Type drop-down list, select OATH.
5. Choose the first factor: Password or External authentication.

If Password is chosen:

• Enter password’s static part.
• Fields Token type, Token length and Time step will be filled out automatically as default settings claim. Their value is editable.
• Enter a secret that will be used by Google Authenticator. Note, that the secret must be a Base32 encoded value. Alternatively, click . to generate it automatically. Click to show the QR code.

If External authentication is chosen:

• Select External authentication source.
• Fields Token type, Token length and Time step will be filled out automatically as default settings claim. Their value is editable.
• Enter a secret that will be used by Google Authenticator. Note, that the secret must be a Base32 encoded value. Alternatively, click . to generate it automatically. Click to show the QR code.

Note

The Initialized option serves for the user’s initialization via the QR code. When their static password as a First factor setting is filled or External authentication source if configured, the QR code is displayed during their first connection. After successful first authentication the Initialized option becomes checked and takes uneditable state.

6. Click Save.
7. Launch Google Authenticator and add new service.

Manual entry	QR Code
Select Enter a provided key. Enter account name. Enter the secret defined in OATH authentication method. Note Click . on the user edit form in the Authentication section to reveal the secret. Select Counter based. Select ADD.	Click . on the user configuration form, next to the Secret field in the Authentication section. Select Scan a barcode in Google Authenticator.

8. When logging in, the password string consists of a static password defined in the authentication method and dynamic part generated by the Google Authenticator, e.g. password481418.

Related topics:

• User authentication methods and modes