Management - LinOTP

Settings
Caching
GUI settings
Client Identification

Split at @ sign (splitAtSign):
Return SAML attributes:
FailCounterIncOnFalsePin:
PrependPin:
Auto resync:
Auto resync timeout:

Authentication

Pass on user not found:
Pass on user no token:
Log usage timestamps in token info:
Custom timestamp format (optional):

Authorization Override authentication client:

Note: Parameter-based client address overrides are deprecated. For now, you can re-enable this feature by setting the LinOTP config variable, GET_CLIENT_ADDRESS_FROM_POST_DATA, to 'True'. This feature may be removed entirely in a future version of LinOTP. Please use the standard 'X-Forwarded-For' headers in LinOTP API requests in your own code.

Resolver Lookup Caching

Enable
Expiration

User Lookup Caching

Enable
Expiration

Selfservice portal

Display realm select box

Client Identification with Proxy

Support for HTTP_X_FORWARDED_FOR
Support for HTTP_FORWARDED
Trusted Forwarding Proxy:

Do you want to delete the provider?

Do you want to delete the Provider?

Do you want to delete the voice provider?

TOTP Token
Remote Token
Yubico
OCRA2 Token
QRToken
PushToken
SMS Token
E-Mail Token
RADIUS Token
Default Settings

QRToken Settings

Maximum concurrent challenges
Challenge expiration time (sec)
OTP length
Public key certificate

Default token settings

DefaultResetFailCount:
DefaultMaxFailCount:
DefaultCountWindow:
DefaultSyncWindow:
DefaultOtpLen:
Challenge expiration time (sec):

If LinOTP is setup to manage its administration users, you can change your LinOTP management password now.

User:

LinOTP - the open source solution for two factor authentication.

Licensed under AGPLv3

For more information please visit: https://www.linotp.de

View latest changelog

Authors:
Cornelius Kölbel, Kay Winkler, Omar Kohl, Friedrich Weber,
Christian Pommranz, Reinhard Stampp, Rainer Endres,
Stefan Pietsch, Eric Sesterhenn, Marian Pascalau,
Fabian Vallon, Veronika Schindler, Lukas Engelter,
Mirko Ahnert, Chris Halls

Selected Tokens:

Usage Count Set maximum usage limits for the entire token lifetime.
Max. authentication attempts:
Max. successful authentications:
Validity Period Set the period of time where the token is enabled.
Valid from:
Valid until:

You may reset the PINs for the tokens

The token will be enrolled for user .

Currently this token will not be assigned to any users.

[?]

You selected more than one user. If you want to assign the token to a user during enrollment, you need to select only one user. Anyhow, you can assign this token to any user later on.

Token type

Token seed:
Create a new OATH token - HMAC time based
Generate random seed
Enter seed
Token settings:
Google Authenticator compliant
OTP digits
Hash algorithm
Time step
Description
Token PIN:
Enter PIN:
Confirm PIN:

Here you can define to which LinOTP Server the authentication request should be forwarded.

You can either forward the OTP to a remote serial number or to a remote user.

If you do not enter a remote serial or a remote user, the request will be forwarded to the remote user with the same username.

Token PIN:
Remote server
Check PIN
Remote OTP len
Remote serial
Remote user
Remote user realm
Remote user UserIdResolver
Enter PIN:
Confirm PIN:

Here you can define to which token the authentication request should be forwarded.

You can forward the OTP to a target serial number.

Token Pin:
forward serial
enter PIN:
confirm PIN:

Please enter or copy the init-secret, that was generated by your app and the PIN you are using on your phone.

Token PIN:
Init secret
mOTP PIN
(again)
Description
Enter PIN:
Confirm PIN:

Here you need to enter the token ID of the YubiKey.

You can do this by inserting the YubiKey and simply push the button.

Token PIN:
Token ID
Description
Enter PIN:
Confirm PIN:

Please enter or copy the OCRA2 key.

Token PIN:
OCRA2 key
	Generate OCRA2 key.
OCRA suite
Description
Enter PIN:
Confirm PIN:

Token PIN:
Description
OTP Digits:
Enter PIN:
Confirm PIN:

Token PIN:
Description
OTP Digits:
Enter PIN:
Confirm PIN:

Please enter the mobile phone number for the Voice token

Token PIN:
Phone number
Description
Enter PIN:
Confirm PIN:

Please enter the mobile phone number for the SMS token

Token PIN:
Phone number
Description
Enter PIN:
Confirm PIN:

Token PIN:
E-mail address
Description
Enter PIN:
Confirm PIN:

Here you can define the 'Tagespasswort' token, that changes every day.

Token PIN:
DPW key
Description
Enter PIN:
Confirm PIN:

Token Password:
Create Static Password Token
Enter seed
Token settings:
Description
Token PIN:
Enter PIN:
Confirm PIN:

Token seed:
Create a new OATH token - HMAC event based
generate random seed
Enter seed
Token settings:
Google Authenticator compliant
OTP Digits
Hash algorithm
Description
Token PIN:
Enter PIN:
Confirm PIN:

Here you can define, to which RADIUS server the request should be forwarded.

Please specify the server, the secret and the username

Token PIN:
RADIUS server
Check PIN
RADIUS shared secret
RADIUS user
Enter PIN:
Confirm PIN:

Here you can search for the serial of a token.You need to enter the current OTP value, and choose where you want to search for this token.

Beware: This can be time consuming!

Type

Assigned token

Realm

OTP value

Here you can check your policies.

You can enter the corresponding values and the system will check, if there is any matching policy for this scenario.

Here you can export token information of the tokens you are allowed to view to a CSV file.

You can enter additional attributes, you defined in the user mapping in the UserIdResolver. These attributes will be added to the CSV file.

Here you can export the audit information to a CSV file.

Number of audit entries to export:

Page to export:

With this dialog you can import users to create an internally managed user resolver.

You can upload csv files with the following column order:

username	userid	surname	givenname	email	phone	mobile	password

CSV Configuration

Field delimiter:
Text delimiter:
Password format:	plaintext (will be hashed during import) secure hash
Skip first line (header information)

The users of the csv file will update an existing or populate a new managed resolver. The target resolver has to be added to a realm after the import.

Resolver:

or create new...

The user import from the selected file would result in the following changes. If results are as expected, you have to complete the import by confirming the changes.

Summary

Here you can copy the OTP PIN from one token to the other.

Please enter the serial number of the token with the existing PIN and the serial number of the token, that should get the same PIN.

From token

To token

Migrate assigned tokens to a new resolver

From resolver
To resolver

Here you may upload the XML file of any OATH compliant OTP Token.The LinOTP server will automatically recognize if the token is an HOTP (event based) or a TOTP (time based) token. If the HMAC secrets are encrypted you either need - depending on the encryption - the password or the encryption key.

Please choose the token file:

Check the serial numbers for OATH compliance (non-compliant serial numbers will be ignored)

Target realm:

Enable all tokens:

Here you can upload a CSV file for your OATH token. The file is supposed to contain one token per line:

For HOTP and TOTP tokens:

Serial number, Seed, Type, [OTP length], [Time step], [hashlib]

Possible Values:

Type	->	HOTP, TOTP
OTP length	->	6, 8
Time step	->	Recommendation 30
Hashlib	->	SHA1, SHA256, SHA512

For OCRA2 tokens:

Serial Number, Seed, Type, Ocra Suite

Type	->	OCRA2
Ocra Suite	->	OCRA-1:HOTP-SHA256-8:C-QN08, OCRA-1:HOTP-SHA256-8:C-QA64

Default values:

Type	->	HOTP
OTP length	->	6
Time step	->	30
Hashlib	->	Choosen based on hash length. Fallback: SHA1

Please choose the token file:

Target realm:

Enable all tokens:

Create a new realm or select one available realm:

Create a new or select one available UserIdResolver:

Which type of resolver do you want to create?

The following tokens will be permanently deleted and can not be recovered.

Enrolled the token for user .

Token serial:

The token was lost? You may enroll a temporary token and automatically disable the lost token.

You may resync the token: .

Therefor please enter two OTP values.

You may get OTP values for token:

Enter the number, how many OTP values you want to retrieve:

The following Tokens will be unassigned from the their users:

The users will not be able to authenticate with this token anymore. Are you sure?

Do you want to delete the realm ?

Do you want to delete the resolver?

Name:
Type:

Token enrolled. Use the old PIN with the new password. The temporary token can be used till the end date.

Serial:
Password:
End date:

Server Configuration

Resolver name:
Server-URI:
TLS:	Use STARTTLS for 'ldap://' connections Your connection will not be encrypted if you do not use STARTTLS or 'ldaps://'
TLS:	Only allow system-trusted certificates Your connection will be vulnerable to security attacks if you disable certificate chain validation
BaseDN:
BindDN:
Bind Password:	If security relevant information is changed, for example the URL, the password has to be provided to avoid unprivileged exposure of the password.
Timeout:
Sizelimit:
	No anonymous referral chasing

Mapping Attributes

LoginName Attribute:
Searchfilter:
Userfilter:
Attribute mapping:
UID Type:

Server Configuration

Resolver name:
Server-URI:
CA Certificate:
Auth User:
Password:
Timeout:
	Testing connection ...

JSON Configuration

UserId
Username
Userlist

URL path:
Parameters:
Result path:
Attribute mapping:

URL path:
Parameters:
Result path:
Attribute mapping:

URL path:
Parameters:
Result path:
Attribute mapping:

Server Configuration

Resolver name:
Driver:
Server:
Port:
Database:
User:
Password:	If security relevant information is changed, for example the URL, the password has to be provided to avoid unprivileged exposure of the password.
Database table:
Limit:
Database encoding:
Additional connection parameters:

Mapping Attributes

Attribute mapping:
Where statement:

Resyncing of token failed

Resynced token successfully

set PIN successfully

When displaying Token information you may only select one single Token.

When retrieving the token type you may only select one single Token.

Error: unknown tokentype in function token_enroll()

Could not find a token for this OTP value.

Error finding a token to this OTP value.

Failed to communicate to LinOTP server

unknown token type to load!

You may only upload support subscription files ending with .pem

Error saving SMS configuration. Please check your configuration and your server

Error saving system configuration. Please check your configuration and your server

Error saving system checkboxes configuration. Please check your configuration and your server

Regexp error in realm. You need to select ONE realm to set it as default.

Policy set.

Policy name is not defined!

Policy deleted.

Error fetching list!

created token with serial

losttoken failed:

set token PIN failed:

Error while fetching the tokentype:

Error creating token:

Failed:

Failed to import token:

Token import result:

Failed to import policies:

Policy import result:

Failed to load support subscription:

Support subscription import result:

Error saving ldap configuration.:

Error saving realm configuration.:

Realm created:

Error setting Token realms:

Error saving file configuration:

Error saving sql configuration:

Resolver deleted successfully:

Failed deleting resolver:

Realm deleted:

Failed deleting Realm:

LDAP Server configuration seems to be OK! Number of users found:

Error loading LDAP resolver:

HTTP Server configuration seems to be OK! Number of users found:

Error loading HTTP resolver:

Error loading SQL resolver:

SQL config seems to be OK! Number of users found:

SQL config contains errors:

Unknown PIN type:

You entered invalid data. Please check all the Tabs!

Error occurred during processing:

You have defined UserIdResolvers. But you need to create at least one realm that contains some of your UserIdResolvers. The realm Dialog will now open to do this.

This realm is already the default realm.

Incorrect or missing input at:

Please have a look at each of the forms for more details.

Form Validation Error

License reminder:

Support license installed successfully.

OATH Soft Token

QR-Code for installing the token in OATH compatible Soft Tokens (FreeOTP, Google Authenticator and other tokens using the 'otpauth:/' syntax).

'OATH token' app

QR-Code for installing the token in the 'OATH Token' app for iOS.

OTP seed

The OATH token seed for installing the token using manual input.

Communicating with LinOTP server...

Name:
Class:
Config:
Timeout (sec):

Name:
Class:
Config:
Timeout (sec):

Name:
Class:
Config:
Timeout (sec):

Yubico ID
Yubico API key
Yubico Url
Yubico Timeout

Challenge expiration time (sec)
Challenge blocking time (sec)

time step:	sec
time offset:	sec
time lookup window:	sec

Usage Count

Validity Period

Summary

Details

For HOTP and TOTP tokens:

For OCRA2 tokens:

Default values: