HP-UX AAA Server A.08.01 administrator's guide (T1428-90072, May 2010)

SQLAction RetrieveToken {
{
input
RAD(User-Id, REPLY) DBP(userid, 253, CHAR)
output
DBR(100:*) RET(RETRIEVE_ERROR)
DBR(-1:*) RET(ERROR)
DBC(serial_number, 128, CHAR) RAD(Otp-Token-Serial-Number, REPLY)
DBC(token_status, 128, CHAR) FUNC(AAATokenStatusCheck)
DBC(seq_counter, 38, CHAR) RAD(HOtp-Seq-Counter, REPLY)
DBC(shared_secret, 128, CHAR) FUNC(AAASetConvertedHexToBinaryString)
DBR(0:0) RET(RETRIEVE_SUCCESS)
DBR(*:*) RET(RETRIEVE_ERROR)
SQLStatement db_oci {
SELECT serial_number, token_status,
seq_counter, shared_secret
FROM RAD_TOKENS_TABLE
WHERE user_name=:userid
}
}
}
In this example, the Otp-Token-Length attribute has been added in the last row. If
you are using RetrieveUserAndToken SQL action, similar changes will be required
there to configure OTP attributes at a user level.
NOTE: The corresponding values for the attributes configured in the
sqlaccess.config file must be stored in the user profile and in RAD_TOKENS_TABLE
in the database.
Advanced Deployment Scenarios
This section documents the procedures for configuring OTP and two-factor
authentication in the following deployment scenarios:
• “Validating OTP Alone” (page 200)
• “Configuring Two-Factor Authentication” (page 202)
— “If User and Token Information is in Different SQL Database Tables” (page 202)
— “If User and Token Information is in the Same SQL Database Table” (page 204)
— “If User and Token Information is in Different Databases” (page 207)
• “OTP or Password Validation at External RADIUS Server” (page 210)
— “Validating Password on the Local Server and Forwarding OTP to Another
RADIUS Server” (page 210)
— “Validating OTP on the Local Server and Forwarding Password to Another
RADIUS Server” (page 214)
— “Forwarding OTP and Password to Another RADIUS Server for Validation”
(page 217)
Configuring OTP Authentication on the HP-UX AAA Server 199