HP-UX AAA Server A.08.01 administrator's guide (T1428-90072, May 2010)

Notes:
• The scenarios described in this section are applicable whether you are using
RADIUS standard password authentication or EAP authentication.
• The HP-UX AAA Server supports only the following EAP authentication methods
for OTP authentication:
— PEAP (EAP-GTC)
— TTLS (PAP and MS-CHAP v2)
• Creating different inner and outer realms for OTP authentication is supported
only for TTLS (PAP and MS-CHAP v2). For information on creating tunneled EAP
realms, see “Adding a Realm” (page 105).
Validating OTP Alone
To configure the HP-UX AAA Server to validate OTP alone, complete the following
steps:
1. Configure the realm using the Realms Screen of the Server Manager. While
configuring the realm, use the procedure listed in “Configuring Realms for Database
Access via SQL” (page 111). In the User Storage Parameters field, ensure that the
RetrieveToken SQL action is selected and the configuration is saved. For more
information on configuring the realm, see “Adding a Realm” (page 105).
2. If not appended , append the contents of the sample OTP reference implementation
policy files (located in /opt/aaa/examples/config) to the default policy files
(located in /etc/opt/aaa) using the following commands:
# cat /opt/aaa/examples/config/oath-request-ingress.grp >> /etc/opt/aaa/request-ingress.grp
# cat /opt/aaa/examples/config/oath-reply-egress.grp >> /etc/opt/aaa/reply-egress.grp
3. In the /etc/opt/aaa/request-ingress.grp file, replace the <realm> variable
and configure the Otp-ActionId attribute according to the following rules:
Then …
If you have
configured...
Replace the <realm> variable in the following syntax with the realm name configured
in Step 1:
if ((count (User-Name) > 0) && (substr (User-Name after "@") = "<realm>"))
{
The realm
for RADIUS
standard
password or
insert Otp-ActionId = 16
MS-CHAP
exit "ACK"
}
v2
authentication
200 OATH Standards-Based OTP Authentication