1. LinOTP Management Guide

• 1.1. Introduction
  • 1.1.1. System Overview
  • 1.1.2. Components
  • 1.1.3. LinOTP core
  • 1.1.4. OTP Calculation
  • 1.1.5. UserIdResolver
  • 1.1.6. Authentication Modules
  • 1.1.7. Management Clients
  • 1.1.8. Features of different management clients
  • 1.1.9. Licenses
    • LinOTP Server
    • LinOTP Administration Clients (adminclients)
    • LinOTP Management GUI
    • LinOTP Authentication Connectors (authmodules)
    • LinOTP User Connectors (UserIdResolver)
    • LinOTP SMS Connectors
• 1.2. Quick Start Guide Token Management
  • 1.2.1. What this guide is about
  • 1.2.2. Getting started - the Web UI
  • 1.2.3. UserIdResolvers
    • Create UserIdResolver
  • 1.2.4. Create Realm
  • 1.2.5. Create Token
  • 1.2.6. Assign Token to User
  • 1.2.7. Test authentication procedure
• 1.3. Configure Resolvers and Realms - The Details
  • 1.3.1. UserIdResolvers and Realms - The Concepts
    • Authenticating with Realms and UserIdResolvers
  • 1.3.2. Configuring UserIdResolvers
    • Configuring LDAP UserIdResolver
    • Configuring SQL UserIdResolver
    • Configuring Passwd (Flatfile) UserIdResolver
      • Using /etc/passwd
      • Using a separate file
  • 1.3.3. InternalSQLResolver
    • Create InternalSQLResolver
    • Change InternalSQLResolver
  • 1.3.4. Configuring Realms
• 1.4. Supported tokens
  • 1.4.1. Tokens
    • Hardware Tokens
    • Soft Tokens
    • Tokens for login and transaction security (challenge response)
      • LinOTP QR Token
      • LinOTP Push Token
    • Challenge Response Tokens
    • Special Tokens
  • 1.4.2. Recommended Mobile Apps
    • Recommended HOTP Apps
      • Apps for the iPhone
      • Apps for Android
    • Recommended mOTP Apps
      • Apps for iPhone
      • Apps for Android
      • Apps for Windows Phone
• 1.5. Managing Tokens
  • 1.5.1. Tokentype Configuration
    • Global - Default Settings
    • E-Mail Token - Default Settings
    • OCRA2 Token - Default Settings
    • QRToken - Default Settings
    • RADIUS Token - Default Settings
    • Remote Token - Default Settings
    • SMS Token - Default Settings
    • TOTP Token - Default Settings
    • Yubico Token - Default Settings
  • 1.5.2. Import tokens
    • Importing tokens with the Web UI
      • Importing PSKC files
      • Importing OATH CSV files
      • Importing Tagespasswort files
  • 1.5.3. Viewing users in certain realms
    • Viewing users in the Web UI
  • 1.5.4. Viewing tokens in the WebUI
  • 1.5.5. Assign tokens
    • Multiple tokens for a user
    • Assign tokens using the Web UI
  • 1.5.6. Set OTP PIN
  • 1.5.7. Enrolling tokens
    • Enroll eToken NG-OTP
    • Enroll mOTP Token
    • Enroll HOTP, TOTP and OCRA2 Tokens
    • Enroll LinOTP Static Password Token
    • Enroll SMS OTP / Mobile TAN
    • Enroll Remote Token
    • Enroll Forwarding Token
    • Enroll RADIUS Token
    • Enroll LinOTP QR Token
    • Enroll LinOTP Push Token
    • Enroll OCRA2 Token
    • Enroll YubiKeys
      • Enrolling OATH/HOTP mode
      • Enrolling Yubico mode
      • Enrolling static mode
      • Enrolling Cloud mode
      • Enrolling Challenge Response mode
    • Enroll E-Mail Token
  • 1.5.8. Manage tokens
    • Unassign
    • Remove
    • Disable
    • Reset fail counter
    • Set Expiration
    • Resync token
  • 1.5.9. FIDO U2F
    • Overview
    • Example for U2F with LinOTP
      • Set up required policy
      • U2F token enrollment
      • Authentication with the assigned token
  • 1.5.10. Set token realm
  • 1.5.11. Token info
  • 1.5.12. Lost token
  • 1.5.13. Get serial by OTP
  • 1.5.14. Get OTP
  • 1.5.15. Users with no token
  • 1.5.16. UserIdResolver migration
• 1.6. Policies
  • 1.6.1. Introduction
  • 1.6.2. Admin Policies
  • 1.6.3. Audit Policies
  • 1.6.4. Authentication Policies
    • OTP PIN variants
    • Authentication Passthrough
    • Pass on no Token
    • Challenge Response
    • Forward Request to Remote Server
    • Forward Request to Remote Server for User without Token only
    • Setup LinOTP QR Token
      • Call back Pairing URL for Activation of LinOTP QR Tokens
      • Call back Challenge URL for Authentication with LinOTP QR Tokens
      • Support for Offline QR Tokens
    • LinOTP Push Token Policies
      • Call back Pairing URL for Activation of LinOTP PushTokens
      • Call back Challenge URL for Authentication with LinOTP PushTokens
    • URL for OCRA2 Tokens
    • Choose SMS Provider
    • SMS Provider Failover
    • Automatic SMS sending
    • SMS Text
    • Enforce SMS Text
    • SMS Dynamic Mobile Number
    • Choose E-mail Provider
    • Email Subject
    • Email Text
    • Email dynamic address
    • Automatically Disable or Delete Token
      • Disable Token
      • Delete Token
  • 1.6.5. Authorization Policies
    • Authorization
    • Token Types
    • Serials
    • Setting Realms
    • Returning Details on validation
  • 1.6.6. Enrollment Policies
    • Token limits per Realm
    • Token limits per user
      • Total number of tokens per user:
      • Number of tokens per user by type:
    • Random OTP PIN
    • Encrypted OTP PIN
    • Token issuer
    • Token labels
    • Auto Assignment
    • Ignore Auto Assignment Pin
    • Autoassigment without Password Check
    • Lost token
    • Purge rollout tokens
    • U2F App ID
    • U2F Valid Facet
  • 1.6.7. Gettoken Policies
  • 1.6.8. Notification Policies
    • Token autoenrollment with user notification
  • 1.6.9. Reporting Policies
    • Activate Reporting
      • Total Number of Tokens
      • Token in certain States
    • Configure Access
      • Show Token
      • Show Maximal Number of Tokens
      • Delete data from Reporting Database
        • Delete all data
        • Delete data before a certain date
  • 1.6.10. Monitoring Policies
  • 1.6.11. Selfservice policies
    • OTP PIN policies
      • Character groups
      • Changing the character group definition
      • Reversing the OTP PIN logic
    • Retrieving OTP values
    • Verify policy
  • 1.6.12. System policies
  • 1.6.13. Users in policies
    • Extensions for user field in LinOTP =>2.8.1
      • Examples
  • 1.6.14. Clients in policies
  • 1.6.15. Policy checker
  • 1.6.16. Importing and exporting policies
  • 1.6.17. Best practice - policy example
    • Administrators
    • System
    • Selfservice
• 1.7. Audit Trail
  • 1.7.1. Logging Scopes
    • Selfservice Portal
    • Validate
    • Audit Trail
    • Administrative Tasks
    • System configuration
    • Setting License
  • 1.7.2. Viewing the Audit Trail
  • 1.7.3. Configuration
  • 1.7.4. Searching the Audit Trail
    • Search in SQL Audit
• 1.8. Challenge Response
  • 1.8.1. HOTP and TOTP Tokens
  • 1.8.2. SMS and e-mail
  • 1.8.3. Configure Challenge Message
  • 1.8.4. RADIUS
  • 1.8.5. Test Challenge Response
• 1.9. SMS Provider for SMS OTP Tokens / Mobile TANs
  • 1.9.1. Overview
    • Triggering SMS
    • Configuration
      • Policy to choose SMS Provider
  • 1.9.2. Configure SMS Provider
    • Generic Options
    • Overview SMS Provider modules
      • HttpSMSProvider
      • SmtpSMSProvider
      • SMPPSMSProvider
      • RestSMSProvider
      • DeviceSMSProvider
  • 1.9.3. SMSProviderConfig
    • HttpSMSProvider
    • SmtpSMSProvider
    • SMPPSMSProvider
    • RestSMSProvider
    • SMPPSMSProvider
    • DeviceSMSProvider
• 1.10. E-mail Provider for E-mail Token
  • 1.10.1. Overview
    • Triggering challenge (e-mail)
    • Configuration
      • Policy to choose E-Mail Provider
  • 1.10.2. Configure E-mail Provider details
  • 1.10.3. E-mail ProviderConfig
    • SMTPEmailProvider
• 1.11. Push Provider for LinOTP Push Token
  • 1.11.1. Configuration
    • Policy to Choose Push Provider
    • Configure Push Provider
      • Configuration details of the DefaultPushProvider
  • 1.11.2. Testing of the LinOTP Push Token
    • Push Token via Test Page
    • Test Push via API
      • Trigger the Push Messages
      • Check Result
• 1.12. System Config
  • 1.12.1. Tab Settings
    • Field Authentication
    • Field Authorization
  • 1.12.2. Tab Caching
  • 1.12.3. Tab GUI settings
  • 1.12.4. Tab Client Identification
    • Key differences between supported headers
    • Is my proxy configuration correct?
• 1.13. Security Module
  • 1.13.1. PKCS11 module and SafeNet LunaSA
  • 1.13.2. Password handling
  • 1.13.3. PKCS #11 and YubiHSM Padding bug
    • Technical details
• 1.14. Retrieving OTP values
• 1.15. Tools
  • 1.15.1. linotp
    • linotp local-admins
    • linotp audit
  • 1.15.2. linotp-tokens-used
  • 1.15.3. linotp-backup
  • 1.15.4. linotp-restore
  • 1.15.5. linotp-convert-token
  • 1.15.6. linotp-convert-xml-to-csv
  • 1.15.7. linotp-decrypt-otpkey
  • 1.15.8. LinotpLDAPProxy.pm
• 1.16. Backup and Restore
  • 1.16.1. Backup database and encryption key
  • 1.16.2. Backup additional resources
  • 1.16.3. Disaster Recovery
• 1.17. Monitoring / Reporting
  • 1.17.1. Monitoring
    • Perform Queries
    • License
    • Storage encryption
    • Tokens
    • UserIdResolver
  • 1.17.2. Reporting
    • Prerequisites
    • Configuration
      • Activating Reporting and Reporting access
      • Current limitations
    • Reporting Modes
    • Evaluation / Reporting APIs
    • Perform Queries
      • show or period
      • maximum
      • Delete counters from database with delete_all
      • Delete counters from database with delete_before
• 1.18. PCI DSS
• 1.19. Usage scenarios
  • 1.19.1. Protection levels
• 1.20. Troubleshooting
  • 1.20.1. LDAP/Active Directory Connection
  • 1.20.2. Testing the Freeradius Server
  • 1.20.3. RADIUS Authentication fails
  • 1.20.4. RADIUS server log file
  • 1.20.5. Access to Web API
  • 1.20.6. OTP Authentication
  • 1.20.7. LinOTP server log file
    • Special logging configuration
• 1.21. The LinOTP configuration
  • 1.21.1. Configuration parameters
  • 1.21.2. Setting the configuration parameters in a configuration file
  • 1.21.3. Setting the configuration parameters via environment variables

1.22. Indices and tables

• Index

• Module Index

• Search Page