SLAPO_OTP(5)

💅 SLAPO_OTP — the slapo-otp page, bestie edition ✨

okay so you're here for the slapo-otp manual page (it lives in File Formats Manual, section 5, iykyk) and honestly? it's giving two-factor icon energy. let's go 🎀

---

✨ NAME ✨

slapo-otp — the OATH One-Time Password module, aka the thing that makes your LDAP password do a little duet with a 6-digit code 🌸

---

🦋 SYNOPSIS 🦋

moduleload otp.la

that's it. that's the whole synopsis. slay 💅

---

👑 DESCRIPTION 👑

so the otp module lets you use time-based one-time passwords (you know, the "authenticator-style" ones) and HMAC-based one-time passwords alongside a regular LDAP password, for that sweet sweet two-factor authentication life ✨

with this module loaded, users authenticate by typing their password followed by the one-time password right there in the password prompt. one prompt, two secrets, no extra drama 💖

the password a user needs is calculated from a counter (the current time, in the TOTP case) plus a key that's referenced in the user's LDAP entry. and because it's based on time or on how many times it's been used, it changes periodically. once it's been used, it cannot be used again — so keyloggers and shoulder-surfers are officially thwarted, no cap 🔥. a mobile phone application like Google Authenticator or YubiKey (what the page calls a prover) can crunch the current one-time password for the user, which comes out as a (usually six-digit) number 🔢

alternatively, the value can be calculated by some other application that has access to the user's key and then delivered to the user over SMS or some other channel 📱. when the user gets prompted to authenticate, they just append the code the prover gave them to the end of their password. easy.

this implementation complies with RFC 4226 HOTP HMAC-Based One Time Passwords and RFC 6238 TOTP Time-based One Time Passwords, and it supports the SHA-1, SHA-256, and SHA-512 HMAC algorithms 🧚

the HMAC key used in the OTP computation lives in the oathOTPToken entry that's referenced in the user's LDAP entry, and the parameters live in the oathOTPParams LDAP entry that's referenced in the token. nesting! we love a reference chain 💜

---

🎀 CONFIGURATION 🎀

once the module is configured on the database, it will intercept LDAP simple binds for users whose LDAP entry has any of the oathOTPUser-derived objectclasses attached to it 👀. the attributes linking the user and the shared secret are:

• oathTOTPToken: <dn> — mandatory for oathTOTPUser. says that the named entry is the designated holder of the time-based one-time password shared secret and the last password used 🔐
• oathHOTPToken: <dn> — mandatory for oathHOTPUser. says that the named entry is the designated holder of the one-time password shared secret and the last password used 🔐
• oathTOTPParams: <dn> — mandatory for oathTOTPToken. says that the named entry is the designated holder of the parameters for generating the time-based one-time password shared secret: its length, the algorithm to use, plus the length of each time step and the grace period ⏳
• oathHOTPParams: <dn> — mandatory for oathTOTPToken. says that the named entry is the designated holder of the parameters for generating the one-time password shared secret: its length, the algorithm to use, plus the permitted number of passwords to skip ⏳

the overlay also intercepts LDAP Compare requests against the oathSecret attribute of an oathTOTPToken or oathHOTPToken entry, and checks the asserted value against the configured secret 🔍. this is subject to compare access to the attribute, so mind your ACLs bestie.

the following parts of the OATH-LDAP schema are implemented 💫

General attributes 🌈

• oathSecret: <data> — the shared secret is stored right here, as raw bytes 🧬
• oathOTPLength: <length> — the password length. usually 6 ✨
• oathHMACAlgorithm: <OID> — the OID of the hash algorithm to use, as defined in RFC 8018. supported algorithms include SHA1, SHA224, SHA256, SHA384 and SHA512 🔐

The HOTP attributes 💀

• oathHOTPLookAhead: <number> — how many successive HOTP tokens are allowed to be skipped 🙈
• oathHOTPCounter: <number> — the order of the last HOTP token the user successfully redeemed 🔢

The TOTP attributes ⏰

• oathTOTPTimeStepPeriod: <seconds> — the length of the time-step period used for TOTP calculation ⏳
• oathTOTPLastTimeStep: <number> — the order of the last TOTP token the user successfully redeemed 🔢
• oathTOTPTimeStepWindow: <number> — how many time periods around the current time get tried when checking the password the user provided 👀
• oathTOTPTimeStepDrift: <number> — if the client didn't hand over the correct token but it still fit inside oathTOTPTimeStepWindow above, this attribute records the current offset to apply, to cover slow clock drift of the client device 🕰️

---

🌸 SEE ALSO 🌸

• slapd-config(5).

---

💖 ACKNOWLEDGEMENT 💖

this work was developed by Ondřej Kuzník and Howard Chu of Symas Corporation for inclusion in OpenLDAP Software 👑🫶

this work reuses the OATH-LDAP schema developed by Michael Ströder 🌟

---

ngl, that was a lot of attributes, but you ate that. go configure your two-factor era 💅

and that's a wrap! this page is from SLAPO-OTP, dated 2018/6/29, and it's the SLAPO_OTP(5) page — stay secure, bestie 😭💜