IBM Tivoli Federated Identity Manager, Version 6.2.2

One-time password overview

Tivoli Federated Identity Manager provides various authentication mechanisms in the point of contact interface.

The point of contact server is a proxy or application server that interacts with a user, does the authentication, and manages sessions. In a typical deployment, the point of contact is at the edge of a protected network behind a firewall, such as in a demilitarized zone.

The authentication methods available in a deployment are typically determined by the point of contact technology that is used in the environment. Points of contact technologies usually provide simple authentication such as the use of a user name and password.

A step-up authentication is a type of authentication where users who attempt to access sensitive resources are required to provide a specific type of credential. They might be challenged to authenticate and provide an additional set of credentials to prove that they are allowed to access sensitive resources. The one-time password authentication can be used where increased security is required.

A multi-factor authentication is a type of authentication where users are required to provide more than one type of credential to access a protected resource.

A one-time password is a unique password that is used to validate a login session. A one-time password cannot be reused. These restrictions make it less vulnerable to replay attacks and more secure than static passwords.

The one-time password authentication capability in Tivoli Federated Identity Manager extends the existing point of contact support with the following features:

Context-based authentication policy determination using a mapping rule
Pluggable one-time password generation and validation with default implementation
Pluggable one-time password delivery with email and short message service (SMS) as default implementation
Pluggable one-time password store with default support for in memory cache

You can implement the use of the one-time password in the federated protocol or extended authentication flow.

Federated single sign-on scenario: This flow consists of allowing multi-factor and step-up authentication operations. This flow relies on a one-time password authentication in the context of a single sign-on protocol.

Extended authentication scenario: This flow consists of allowing multi-factor and step-up authentication operations. This flow relies on a one-time password authentication to extend the authentication capabilities of existing point of contact technologies. This flow is available outside the context of a federated single sign-on.

Feedback