SMS, email, and voice OTP delivery

Configure how the server generates OTPs and delivers them to users. For examples of how the choice of OTP delivery methods affects users, see Token authentication.

1. On the STA Token Management console, select Policy > Token Policies > SMS/Email/Voice OTP Delivery Methods.

   

2. Configure the OTP delivery method settings:

   • OTPs per message—From one to five OTPs can be sent in an SMS message. This method applies only if the SMS token is issued in QUICKLog mode. In this mode, the user receives an SMS message immediately after each successful authentication. By including more than 1 OTP, users that are temporarily outside of an SMS delivery zone will be able to authenticate until all OTPs in the message have been consumed.

     If the SMS token is issued in Challenge/Response mode, the OTP is not sent until the user attempts to logon. SMS Challenge/Response is usually combined with Single Sign-on, whereby the user must first successfully authenticate with the Active Directory password, after which the Virtual Server automatically sends the OTP necessary to complete the authentication and logon process.

   • Resend OTP(s) on Challenge—If checked, the Virtual Server will send an OTP to the user if an empty or 1-character password is submitted in the OTP/password field during authentication.

   • Request Interval—This setting determines the number of minutes that must elapse between Resend OTP on challenge requests. Requests received during this period are ignored by the server.

   • Challenge Time to Live—This setting determines the lifespan of an OTP issued in Challenge/Response mode. An OTP that is unused after this period cannot be used to authenticate.

   • Default delivery method

     • SMS—OTPs are sent to the user using SMS.
       Example delivery message:
       

     • Email—OTPs are sent to the user's email address.
       Example delivery message:
       

     • Voice—OTPs are sent to the user's phone.
       Example delivery message:
       

     • SMS + Email—OTPs are sent to the user through SMS as well as email address. Example delivery message:
       

     It is recommended that Voice OTP only be used with the SMS token template set to challenge/response. This ensures that a call is sent to the user during the authentication process.

     Voice OTP does not distinguish between uppercase and lowercase characters while delivering the OTP or PIN.

   • Override default delivery method with trigger—If enabled, users can:

     • Type s in the passcode field of an authentication prompt to have it delivered by SMS

     • Type e in the passcode field of an authentication prompt to have their OTP delivered by email

     • Type c for both SMS and email delivery.

     If the user types any other character or leaves the passcode field empty, the OTP will be delivered by the default delivery method (if only one SMS token is assigned to the user).

     The trigger characters are available for all authentication channels, including RADIUS.

   • Use the following method—The options are Replacement and Suffix.

     • Replacement—OTPs are sent using the address from the field selected in the Use the following value option (described below). Typically, this will be a valid email address.

     • Suffix—OTPs are sent to an address that is the combination of the data in the Mobile/SMS field (User Detail) and the data contained in field selected in Use the following value option. For example, if Mobile/SMS contains 16135992441 and Custom #2 (selected) contains @na.rogers.com, the email will be sent to 16135992441@na.rogers.com.

     The Use the following method field gets enabled only for Email and SMS + Email delivery methods.

   • Use the following value from—This selection determines the field used to provide the data for Replacement and Suffix. Options are Email, Custom #1, #2, or #3.

3. Select Apply.