Time-based One Time Password Manager
The supplied Time-based One Time Password (TOTP) Manager automatically generates a one-time password when credentials are requested by a Galasa Manager. This might, for example, be to sign on to a CICS region or an IMS TM control region.
To use the TOTP Manager, the following fields must be stored in Secure Storage associated with each credentials tag used by Galasa:
| Property | Description |
|---|---|
| username | The user identifier that will be used during logon |
| mfa | This can be any value, but is used for indexing into CPS properties |
| mfa.secret | An encoded string specific to the user identifier that the generated one time password will be based on. This will be supplied to you by your z/OS security administrator. |
Additionally, the following properties in the CPS are used by the TOTP Manager:
| Property | Optional/Required | Description |
|---|---|---|
| securecredentials.mfa.[TAG].manager | Optional | The fully qualified name of the MFA Manager class. This must be omitted or must specify com.ibm.galasa.security.internal.TotpMfaManager. |
| totp.mfa.[TAG].digits | Required | The number of digits required in each generated one time password. This value will be supplied to you by your z/OS security administrator. |
| totp.mfa.[TAG].digest | Required | The hash algorithm used when generating each one time password. This value will be supplied to you by your z/OS security administrator. |
| totp.mfa.[TAG].interval | Required | The number of seconds that each generated one time password will be valid for. This value will be supplied to you by your z/OS security administrator. |