Wednesday, May 3, 2017

Extending OpenAM HOTP module to display OTP delivery details

OpenAM provide HOTP authentication module which can send OTP to user's email address and/or telephone number. By default, OpenAM doesn't displays user's email address and/or telephone number while sending this OTP. 


Versions used for this implementation: OpenAM 13.5, OpenDJ 3.5
One of the solution can include extending out of the box OpenAM's HOTP module: 
  • Extend HOTP auth module (openam-auth-hotp). 
  • Update below property in extended amAuthHOTP.propertiessend.success=Please enter your One Time Password sent at
  • Extend HOTPService appropriately to retrieve user profile details. 
  • Change extended HOTP module code as per below (both for auto send and on request): 
  • substituteHeader(START_STATE, bundle.getString("send.success") + <Get User contact details from HOTPService>);  


  • Build the custom auth module by using maven.
  • Deploy the custom auth module. Refer instructions: Building and Installing Custom Authentication Modules 
  • Register service and module (Note that for OpenAM v12 use amAuthHOTPExt-12.xml) :
    $ ./ssoadm create-svc --adminid amadmin --password-file /tmp/pwd.txt --xmlfile ~/softwares/amAuthHOTPExt.xml
    $ ./ssoadm register-auth-module --adminid amadmin --password-file /tmp/pwd.txt --authmodule com.sun.identity.authentication.modules.hotp.HOTPExt
    UnRegister service and module (in case module needs to be uninstalled) : 
    $ ./ssoadm unregister-auth-module --adminid amadmin --password-file /tmp/pwd.txt --authmodule com.sun.identity.authentication.modules.hotp.HOTPExt
    $ ./ssoadm delete-svc --adminid amadmin --password-file /tmp/pwd.txt -s sunAMAuthHOTPExtService
  • Configure HOTPExt module with required SMTP server. Enable both SMS and Email.
  • Create a chain(otpChain) with (LDAP:Required, HOTPExt:Required). Set this chain as default for "Organization Authentication"
  • Restart OpenAM
  • Invoke HOTP module and appropriate message is displayed on screen with user's email address and/or telephone number: 

No comments:

Post a Comment