Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

Mobile authentication

Mobile Authentication with OTP

search
printsuggest an edit

Mobile Authentication with OTP

copy link to clipboardIntroduction

The OneWelcome Mobile Security Platform offers an ability of mobile authentication with a One Time Password (OTP). Mobile authentication with OTP provides users an easy and secure way for two factor authentication or single factor authentication where no passwords are required. A good use case is for example letting a user login to your web application using his/her mobile device by scanning a QR code displayed within a browser. This essentially allows the user to authenticate using his/her mobile device. It is also not relying on third party services like APNs or FCM. All of the communication stays between App, web application and Mobile Security Platform.

copy link to clipboardExample Scenario

An Example implementation could work like this: A web application fetches the OTP from the Token Server and displays it on the login page in the form of a QR code. Then the user opens your mobile application and scans the QR code with his camera and is automatically logged in into your website. Of course it's up to you to choose how to implement it, the above scenario is just an example.

copy link to clipboardSetup and Requirements

OTP mobile authentication requires configuration on the Token Server side. Please follow the Mobile Authentication guide in order to setup the OTP mobile authentication type.

copy link to clipboardEnrollment

It is only required to enroll for mobile authentication to use OTP. If the user is not enrolled, you can perform enrollment by following the Enrollment guide.

copy link to clipboardRequest Handling

An generic overview on how mobile authentication functions is shown in the diagram below:

mobile authentication flow with Flutter Plugin

As you can see from the diagram above, the application has the following responsibilities:

  1. Passing the mobile authentication request received from the initiator to the SDK

  2. Responding to the confirmation request

    1. (optionally ) Displaying a dialog to the end-user when his confirmation is required
    2. Sending the end-user response back to the SDK

  3. Handling completion of the mobile authentication request

Once you have retrieved an OTP in your application you need to hand it over in order to let our SDK process it. Use handleMobileAuthWithOtp for passing OTP code.

var qrCodeData = "otpcode"
await Onegini.instance.userClient.handleMobileAuthWithOtp(qrCodeData)
  .catchError((onError) {
        print("An error occured: $onError");
  }).then((value) => {
    print("Mobile Authentication finished!");
  });

The SDK only allows for one mobile authentication flow to occur at the same time. When a second flow is started a platform exception will be thrown.

The SDK will then fire two event actions which notify you about the status of the OTP authentication:

Event Description
OpenAuthOtpEvent Fired when the authentication has started but has not yet been accepted. You can use the message from the event, to display some info to the end-user and ask for his permission to continue
CloseAuthOtpEvent Fired when the authentication has completed, you can use this event to close any dialogs that you have opened

Additional information regarding the attributes these events might have and how to handle them can be found in Event handling. Here is a small example on how you could listen to these events:

var broadCastController = Onegini.instance.userClient.owEventStreamController;

StreamSubscription<OWEvent> openAuthOtpSub = broadCastController.stream.where((event) => event is OpenAuthOtpEvent).cast<OpenAuthOtpEvent>().listen((event) {
    print("received otp message: ${event.message}");
});

StreamSubscription<OWEvent> closeAuthOtpSub = broadCastController.stream.where((event) => event is CloseAuthOtpEvent).listen((event) {
  __ Logic to handle event
});

copy link to clipboardResponding to Authentication Requests

In order to finish the authentication, you need to either accept or deny the authentication request. This can be done with acceptMobileAuthConfirmation() and denyMobileAuthConfirmation() as described in OtpAcceptDenyCallback.

await OneginiOtpAcceptDenyCallback().acceptAuthenticationRequest(context);

await OneginiOtpAcceptDenyCallback().denyAuthenticationRequest(context);

After calling one of these functions, the original promise which you received from calling handleMobileAuthWithOtp will resolve.

On this page