OTP Class

Properties   Methods   Events   Config Settings   Errors  

The OTP class allows creation of single use passwords.

Syntax

class ipworksauth.OTP

Remarks

The OTP class implements the HOTP algorithm defined in RFC 4226 (HMAC-Based One-Time Password) and the TOTP algorithm defined in RFC 6238 (Time-Based One-Time Password). These types of passwords are commonly used as a second factor of authentication in multi-factor authentication scenarios.

To begin decide which algorithm you wish to use and set password_algorithm. Specify the shared secret in the secret property.

Next, depending on the algorithm chosen you may set counter (HOTP) or time_step (TOTP). If these properties are not set, the class will use a default value.

To create the password call create_password. The password property will be populated with the new password.

To validate a password set the password property and call validate_password. The method will return True or False to indicate success or failure.

Property List

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

counter Property

The counter used for HMAC-Based One Time Password creation or validation.

Syntax

def get_counter() -> int: ...
def set_counter(value: int) -> None: ...

counter = property(get_counter, set_counter)

Default Value

0

Remarks

This property holds the counter value used for HMAC-Based One Time Password creation or validation. When password_algorithm is set to paHOTP this value must be specified before calling create_password or validate_password. The value should be incremented each time a password is created.

The default value is 0.

This property is not applicable when using the Time-Based One Time Password algorithm.

password Property

The HMAC-Based or Time-Based One Time Password.

Syntax

def get_password() -> str: ...
def set_password(value: str) -> None: ...

password = property(get_password, set_password)

Default Value

""

Remarks

This property holds the HMAC-Based or Time-Based One Time Password. This property is populated after calling create_password. This property must be set before calling validate_password.

password_algorithm Property

The algorithm used to create or validate the password.

Syntax

def get_password_algorithm() -> int: ...
def set_password_algorithm(value: int) -> None: ...

password_algorithm = property(get_password_algorithm, set_password_algorithm)

Default Value

0

Remarks

This property specifies whether to use the HMAC-Based or Time-Based One Time Password algorithm. Possible values are:

secret Property

The Base32 encoded shared secret used when creating and validating a password.

Syntax

def get_secret() -> str: ...
def set_secret(value: str) -> None: ...

secret = property(get_secret, set_secret)

Default Value

""

Remarks

This property specifies the Base32 encoded shared secret used when creating and validating a password. This should be set before calling create_password or validate_password.

If this is not set before calling create_password a random secret will be automatically generated. This functionality provides an easy way to create new secret values. The length of the secret is defined by SecretLength.

time_step Property

The time step (in seconds) used for Time-Based One Time Password creation or validation.

Syntax

def get_time_step() -> int: ...
def set_time_step(value: int) -> None: ...

time_step = property(get_time_step, set_time_step)

Default Value

30

Remarks

This property specifies the time step (in seconds) used for Time-Based One Time Password creation or validation. When password_algorithm is set to paTOTP this value must be specified before calling create_password or validate_password.

The default value is 30.

This property is not applicable when using the HMAC-Based One Time Password algorithm.

validity_time Property

The validity time of the created password.

Syntax

def get_validity_time() -> int: ...

validity_time = property(get_validity_time, None)

Default Value

0

Remarks

This property returns the remaining validity time in seconds of the created password. After calling create_password this property may be queried to determine for how many more seconds the password will be valid. If the password is no longer valid this property returns 0.

This property is read-only.

config Method

Sets or retrieves a configuration setting.

Syntax

def config(configuration_string: str) -> str: ...

Remarks

config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

create_password Method

Creates a Time-Based or HMAC-Based One Time Password.

Syntax

def create_password() -> None: ...

Remarks

This method creates either a Time-Based or HMAC-Based One Time Password. The password_algorithm property specifies which algorithm to use.

The following properties are applicable when calling create_password.

• password_algorithm
• secret
• counter (required for HMAC-Based One Time Password)
• time_step (applicable for Time-Based One Time Password)

Calling create_password populates the password property with the created password.

If secret is not specified before calling this method a random secret will be automatically generated.

reset Method

Reset the variables to default value.

Syntax

def reset() -> None: ...

Remarks

This method will reset the variables to default value.

validate_password Method

Validates a Time-Based or HMAC-Based One Time Password.

Syntax

def validate_password() -> bool: ...

Remarks

This method validates a Time-Based or HMAC-Based One Time Password. The password_algorithm property specifies which algorithm to use.

The following properties are applicable when calling validate_password.

• password (required)
• password_algorithm
• secret (required)
• counter (required for HMAC-Based One Time Password)
• time_step (applicable for Time-Based One Time Password)

The method will return True if the password is validated, False otherwise.

on_error Event

Fired when information is available about errors during data delivery.

Syntax

class OTPErrorEventParams(object):
  @property
  def error_code() -> int: ...

  @property
  def description() -> str: ...

# In class OTP:
@property
def on_error() -> Callable[[OTPErrorEventParams], None]: ...
@on_error.setter
def on_error(event_hook: Callable[[OTPErrorEventParams], None]) -> None: ...

Remarks

The on_error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

OTP Config Settings

OTP Config Settings

//TOTP
otpauth://totp/MyServiceName:account@company.com?secret=JBSWY3DPEHPK3PXP&digits=6&period=30

//HOTP
otpauth://hotp/MyServiceName:account@company.com?secret=JBSWY3DPEHPK3PXP&digits=6&counter=0

Base Config Settings

OTP Errors

OTP Errors