miniOrange Authentication Service

Overview

miniOrange authentication service combines something you know, or something you have with someone you are to reliably confirm your identity.

Many organizations protect cloud and enterprise application logins with a simple username and password. Entering these two pieces of information grants access to company databases, email accounts, and other sensitive information. But passwords are notoriously insecure. Many users choose weak passwords which can be easily guessed or cracked. Phishing attacks trick people daily into revealing their passwords, and users on unsecured networks (e.g. at Starbucks) can have their passwords sniffed. Malicious viruses and spy-ware can capture passwords and send them over the network to attackers.

Furthermore, it's impossible to tell who has access to your user's accounts, or even if anyone is accessing them illicitly. In the past year alone, attackers have compromised Sony, HBGary, and Gawker (and many more) by simply gaining knowledge of user's passwords.

Clearly passwords are not enough for protecting important logins.

Using Two Factor Authentication

The most practical way to strengthen authentication is to require a second factor after the username/password stage. Since a password is something that a user knows, ensuring that the user also has something or using biometrics thwarts attackers that steal or gain access to passwords.

Traditional two-factor authentication solutions use hardware tokens (or "fobs") that users carry on their keychains. These tokens generate one-time passwords for the second stage of the login process. However, hardware tokens can cost up to $40 each. It takes time and effort to distribute them, track who has which one, and replace them when they break. They're easy to lose, hard to use, and users consistently report high levels of frustration with token-based systems.

Your choice of second factor

miniOrange authentication service has 15+ authentication methods.

You can choose from any of the above authentication methods to augment your password based authentication. miniOrange authentication service works with all phone types, from landlines to smart-phone platforms. In the simplest case, users just answer a phone call and press a button to authenticate. miniOrange authentication service works internationally, and has customers authenticating from many countries around the world.

Key Features

miniOrange Authentication service provides 15+ authentication methods and integrates with applications that do or do not support standards like SAML, OpenID, OAuth, WSFED etc. It also integrates with enterprise products that support legacy protocols like RADIUS. It also integrates with application servers like Websphere, Weblogic and Tomcat. In addition to that it integrates with Spring. It also can be used to augment authentication for products like Siteminder. Our product is available as a service on the cloud or it can also be installed on premise. The key features of our Strong Authentication Service are

15+ authentication methods to choose from that fits all needs
Cloud-based authentication service - Pay per use (On-Prem option also available)
Ready support for Out of band authentication
Ready support for Phone/SIM/IMEI Authentication - No more phone fraud.
SHA 160/256 Algorithms for Secure Key generation
Global Real-time Delivery via multiple SMS / SMTP Gateways
Easy to Use
- Push notifications
- Out of Band Email and SMS
Supports Risk based Access with Device, Location, Behavior, Transaction or Custom based policies
Supports all possible Remote Logins ( Radius VPN,Website Protection, AD FS,Windows Logon )
Much lower total cost of ownership with Instant authentication set up and Flexible Licensing model
Performance & Reliability : 24 *7 availability
REST API based integration architecture which supports both Proxy or Agent based architecture
Very user friendly Web Administration Portal
Integration support
- Cloud Integrations using Plug and play approach (SAML, OpenID, Oauth, ADFS, WS-Fed)
- Enterprise integration including Proxy server integration like Websphere HTTP server, Siteminder, Weblogic/Oracle Server
- Social Login support - with Facebook, Google, Yahoo, LinkedIn etc.

Integration with Directories

miniOrange Authentication service supports integration with an AD using Active directory Federation Services (AD FS) and Active directory Light Weight Directory Services (AD LDS).

ADFS
AD LDS

miniOrange Authentication Solutions

In addition to the above, miniOrange provides ready to deploy solutions for the following

miniOrange Authentication Service details

How to do a quick test of some of our authentication methods?

To do quicktest of the authentication methods provided by miniOrange, navigate through Integration tab and select Quicktest. Refer the steps that follow next:

OTP over SMS
- Select OTP OVER SMS from Authentication Type dropdown.
- Add phone number for which OTP over SMS quicktest is to be tested.
- Click on perform test.
- Enter the OTP received on the phone and click on Validate OTP to verify OTP.
OTP over EMAIL
- Select OTP OVER EMAIL from Authentication Type dropdown.
- Add email address for which OTP over EMAIL quicktest is to be tested.
- Click on perform test.
- Enter the OTP received on the email address specified and click on Validate OTP to verify OTP.
OTP over SMS and EMAIL
- Select OTP OVER SMS AND EMAIL from Authentication Type dropdown.
- Add phone number and email address to receive OTP.
- Click on perform test.
- Enter the OTP received on the email address / on phone number specified and click on Validate OTP to verify OTP.
OUT OF BAND SMS
- Select OUT OF BAND SMS from Authentication Type dropdown.
- Add phone number in the Phone field.
- You will receive a message with Accept or Deny link.
- Click on Accept or Deny the link to perform test.
OUT OF BAND EMAIL
- Select OUT OF BAND EMAIL from Authentication Type dropdown.
- Add email address in the Email field.
- You will receive an email on the Email specified in above with Accept or Deny link.
- Click on Accept or Deny the link to perform test.
SOFT TOKEN
- Select SOFT TOKEN from Authentication Type dropdown.
- Open the i'm me app on your phone, and click on Soft Token tab.
- Enter the Soft Token in OTP field to perform test.
PUSH NOTIFICATION
- Select PUSH NOTIFICATION from Authentication Type dropdown.
- You will receive a push notification on the configured phone.
- Click on Accept/Deny button to do the quick test.
HARDWARE TOKEN
- Select HARDWARE TOKEN from Authentication Type dropdown.
- Plug-in the configured Hardware Token and press the only button on the token. Cursor should be in the text box, while doing this.
- On pressing the button OTP field will be filled with a large number, in this way you can test this authentication method.
KNOWLEDGE BASED AUTHENTICATION
- Select SECURITY QUESTIONS(KBA) from Authentication Type dropdown.
- Enter the answers of the configured questions.
- Click on Verify Answers to test.
MOBILE AUTHENTICATION
- Select MOBILE AUTHENTICATION from Authentication Type dropdown.
- Scan the QR Code to test this authentication method.
PHONE VERIFICATION
- Select PHONE VERIFICATION from Authentication Type dropdown.
- Enter the phone number in Phone field and click on perform test.
- You will receive a phone call for four digit One Time Password.
- Enter this OTP in OTP field and click on Validate OTP to test.
VOICE AUTHENTICATION
- Select VOICE AUTHENTICATION from Authentication Type dropdown.
- Scan the QR Code to test this authentication method.

How our sample application is secured?

You can test our sample application by choosing from the following:

Online Retail Application

You can complete your transaction in two ways:

If you are not logged in
- For testing this, you need to sign out of the Sample Application. In the right-upper-corner, click on sign out. You will be redirected to home page.
- Select Online Retail Application from the home page. Select any item that you want to purchase and then click on Buy.
- Click on Continue as a Guest.
- You will be asked to enter the contact on which you would like to receive OTP.
- Enter the details and click on Send OTP.
- On clicking Send OTP, your Customer Key is read from your saved configurations and a request containing your contact detail and customer key is sent to the Generate URL.
If you are logged in
- In the right-upper-corner, notice that you are shown as signed in.
- This user is already enrolled with Mobile Authentication Service account.
- Select any item and then click on buy.
- Once you click on buy, your customer key is read from your saved configurations and a request containing your username and customer key is sent to the Generate URL.
- If the generation is successful, the OTP will be delivered to the contact that you have mentioned while enrolling this end user in your Mobile Authentication Service account.
On successful generation of OTP, you will be asked to enter the OTP you received on your contact.
Enter the OTP and click on Validate OTP button.
On clicking Validate button, a validation request is sent to the Validation URL.
On successful validation, you will be shown Transaction complete message else Validation Failed message is shown and you'll be asked to enter the OTP again.

Online Banking Application

For testing this you need to be signed in. In the right-upper-corner, notice that you are shown as signed in.
This user is already enrolled with Mobile Authentication Service account.
Enter the fund transfer details and click on Fund Transfer.
Once you click on Fund Transfer, your customer key is read from your saved configurations and a request containing your username and customer key is sent to the Generate URL.
If the generation is successful, the OTP will be delivered to the contact that you have mentioned while enrolling this end user in your Mobile Authentication Service Account.
On successful generation of OTP you will be asked to enter the OTP you received on your contact.
Enter the OTP and click on Validate OTP button.
On clicking Validate OTP button, a validation request is sent to the Validation URL.
On successful validation, you will be shown Transaction complete message else Validation Failed message is shown and you'll be asked to enter the OTP again.

Online Education Application

For testing this you need to be signed in. In the right-upper-corner, notice that you are shown as signed in.
This user is already enrolled with Mobile Authentication Service account.
If you wish to see basic profile of your child click on Basic Profile else to view personally identified information of your child click on Personally Identified Information
Once you click on Personally Identified Information, your customer key is read from your saved configurations and a request containing your username and customer key is sent to the Generate URL.
If the generation is successful, the OTP will be delivered to the contact that you have mentioned while enrolling this end user in your Mobile Authentication Service Account.
On successful generation of OTP you will be asked to enter the OTP you received on your contact.
Enter the OTP and click on Validate OTP button.
On clicking validate button, a validation request is sent to the validation URL.
On successful validation, you will be shown transaction Complete Message and a link to view your child's personal inforamtion else Validation Failed Message is shown and you'll be asked to enter the OTP again.

How can you secure your custom application?

You can secure your custom application by calling our 2 Factor authentication Rest API:

If your users are not enrolled with us, you can still use our authentication service. In this case, the following authentication types would work:OTP over SMS, OTP over EMAIL, OTP over SMS & EMAIL, Out-of-Band SMS & Out-of-Band EMAIL.
You need to send 2 separate request, one for generating the OTP and second for validating the OTP.

How to call our Generate OTP Rest API

To generate an OTP, you need to make a HTTP POST request to our Generate Rest API. Our Generate Rest API accepts the JSON input in the following format:

/* JSON Object format required to generate OTP */ { "customerKey":"abc", /* The customer key provided to you. */ "user": { "email":"[email protected]", /* user's email where OTP needs to be send */ "phone":"1234567890" /* user's phone number where OTP needs to be send */ }, "secondFactorAuthType":"SMS",/* The type of method you want user to authenticate with */ "transactionName":"Transaction Details" }

The following is the JSON Response generated by the Generate Rest API:

/* JSON Response Object for Generation Request */ { "requestId":"req-123", "responseType":"GENERATE", "customerKey":"abc", "user": { "email":"[email protected]", "phone":"1234567890" } "emailDelivery":{ "contact":"[email protected]", "sendStatus":"SUCCESS", "sendTime":"Aug 5, 2013 5:17:17 PM" } "phoneDelivery":{ "contact":"1234567890", "sendStatus":"SUCCESS", "sendTime":"Aug 5, 2013 5:14:07 PM" } "message":"Successfully Generated", "statusCode":"SUCCESS" }

How to call our Validate OTP Rest API

To validate an OTP, you need to make a HTTP POST request to our Validate Rest API. Our Validate Rest API accepts the JSON input in the following format:

/* JSON Object for Validation Request */ { "customerKey":"abc", /* Your customer key */ "user": { "email":"[email protected]", "phone":"1234567890" } "otpToken":"000000" /* The OTP to validate */ }

The following is the JSON Response generated by the Validate Rest API.

/* JSON Response Object for Validation Request */ { "requestId":"req-123", "responseType":"VALIDATE", "customerKey":"abc", "user": { "email":"[email protected]", "phone":"1234567890" } "otpToken":"000000" "message":"Successfully Validated", "statusCode":"SUCCESS" }
If your End Users are enrolled with us along with OTP over SMS, OTP over EMAIL, OTP over SMS & EMAIL, Out-of-Band SMS & Out-of-Band EMAIL, you can also use Soft Token, Hardware Token and Push Notifications as the authentication methods. These additional methods of authentication requires prior configurations before they can be used.
You need to send 2 separate request, one for generating the OTP and second for validating the OTP.

How to call our Generate OTP Rest API

To generate an OTP, you need to make a HTTP POST request to our Generate Rest API. Our Generate Rest API accepts the JSON input in the following format:

/* JSON Object format for generation request with only userKey */ { "customerKey":"abc", /* Your customer key */ "user": { "userKey":"456" /* The User key that you provided to us during enrollment */ }, "secondFactorAuthType":"PUSH NOTIFICATIONS" /* The type of method you want user to authenticate with */ }

The following is the JSON Response generated by the Generate Rest API.

/* JSON Response Object for Generation Request */ { "requestId":"req-123", "responseType":"GENERATE", "customerKey":"abc", "user": { "userKey":"456" } "emailDelivery":{ "contact":"[email protected]", "sendStatus":"SUCCESS", "sendTime":"Aug 5, 2013 5:17:17 PM" } "phoneDelivery":{ "contact":"1234567890", "sendStatus":"SUCCESS", "sendTime":"Aug 5, 2013 5:14:07 PM" } "message":"Successfully Generated", "statusCode":"SUCCESS" }

How to call our Validate OTP Rest API

To validate an OTP, you need to make a HTTP POST request to our Validate Rest API. Our Validate Rest API accepts the JSON input in the following format:

/* JSON Object for Validation Request with only userKey */ { "customerKey":"abc", /* Your customer key */ "user": { "userKey":"456" /* The User key that you provided to us during enrollment */ } "otpToken":"000000" /* The OTP to validate */ }

The following is the JSON Response generated by the Validate Rest API.

/* JSON Response Object for Validation Request */ { "requestId":"req-123", "responseType":"VALIDATE", "customerKey":"abc", "user": { "userKey":"456" } "otpToken":"000000" "message":"Successfully Validated", "statusCode":"SUCCESS" }

How to configure your 2 Factor Authentication method?

To configure 2 Factor Authentication Method refer to the steps given below:

Go to Strong Auth Method.
Select a second factor method from Second Factor Type.
Configure the method accordingly for the method selected for configuring.
Click on Save to save the configuration.

How to change your 2 Factor Authentication method?

To change your authentication method refer to steps that follow:

Go to Strong Auth Method.
Select a second factor method from Second Factor Type to change the second factor method.
Check the checkbox Prompt for second factor during signin to your console
Click on Save to use this new 2 Factor Authentication Method.

How to do inline onboarding?

Inline onboarding is done when an enduser tries to login to the miniOrange Self Service Console, they are navigated to inline registration page to onboard to our system.

How to change your password yourself?

To change your password refer to steps that follow:

Login to your self service console.
Navigate to Account icon-> Change Password
Enter your current password in Current Password field and enter the new password in New Password field.
Click on Change Password, on successful password change you will see message " Your password has been successfully changed".

What if you forget your password?

If you forgot your password, click on Forgot your Password now do the following steps:

On the landing page, enter the Email address and Registered Phone Number.
Now click on Submit button
You will be challenged according to the Forgot Phone Configuration set by administrator.
Complete the challenge
Your password has been successfully reset now, click on the link Click to login to your account.
Now when you login, a prompt of change password is seen, change your password here to login next time.

What if you forget your phone?

If you forgot your phone, you can use the 'Forgot my phone' option to authenticate yourself. For this option to work, your administrator should have enabled 'Forgot my phone' option in miniOrange admin console. miniOrange administrator should login to admin console and go to settings icon -> 'Forgot Phone Configuration' and check on the checkbox that says 'Enable Forgot phone'. Once you enable it, there are three options to choose from

Based on Alternate Email - If this option is chosen, the user will be sent a one time passcode to his alternate email address. You should pick that passcode and enter it when prompted to authenticate yourself.
Based on KBA - In this option, the user will be prompted to answer some knowledge based questions or life questions. If answered correctly, the user will be able to authenticate himself.
Based on Alternate Email and KBA - This option will prompt the user to enter a one time passcode sent to his alternate email followed by answering a knowledge based question in order to authenticate himself.

What if your phone is lost or stolen?

In case your phone is lost or stolen, call or email your administrator and your administrator can give you access through his admin console by doing a variety of things depending on the situation. He can enable 'Forgot my phone' option temporarily. (Never leave this option open always because this is not a safe option). If you already have another phone, then you can ask the administrator to reset your phone number.

What if your phone is discharged?

If your phone is discharged, then follow the steps below to login to your account:

If your phone is temporarily unavailable then you can click on "Forget your phone" link when prompted for any 2 Factor authentication method.
You will be prompted for a security question and/or OTP to your alternate email you have registered with us.
Answer that question and/or enter the otp and you can login to your Gmail account.

What if you upgraded your phone?

If you upgrade your phone, all your configured account's data will be wiped out, now to login again, re-configure your account using configure second factor method.

What if your voice authentication fails?

If voice authentication fails, customer administrator can set the fall back mechanism to be face detection or iris scan or thumb print. For these fall back mechanism extra hardware needs to be deployed.

How to add users?

You can add users to our system in two ways-

Go to the Users/Groups tab -> Manage Users/Groups in Admin Console and click on Add User button to create a new user.

Download sample csv format from our console and edit this csv file according to it and upload it in our console via Bulk Upload.

After uploading the csv file successfully, you will see a success message with a link.
Click on that link you will see list of users to send activation mail. Select users to send activation mail and click on Send Activation Mail. An activation mail will be sent to the selected users.

How to see the Onboarding Status?

To see Onboarding Status go to Users/Groups tab -> Manage Users/Groups and click on On Boarding Status. Here you can see a pie chart, showing the status of users on-boarded.

How to unlock, locked users?

To unlock, the locked users go to the Users/Groups tab and select View Locked Users. Click on Enable to unlock the user.

How to manage groups?

To manage groups navigate through Users/Groups tab -> Manage Users/Groups

Click on View Group button on the right side.
To add a new group click on Create Group. Enter a name of your choice and click on Create Group to add group.
You can delete a group by clicking on Delete button.
To Add and Remove users from a group click on Manage button and follow the steps:

Users not in the group will show up in the left box.
To add a user, click on Add button or click on Add All button to add all users in the group.
You can remove a user from right box, by clicking on Remove button to remove single user or click on Remove All button to remove all users from a group.

How to manage roles?

You can configure admin roles of endusers.

To manage roles navigate through Users/Groups tab -> Manage Roles

To configure role of an Enduser click on Add to add the enduser as Administrator.
You can also remove Administrator privilege by clicking on Remove button.

How to manage shared identities?

To add a shared identity follow the step below:

Go to the Users/Groups Tab and select Manage Shared Identity
You can add an associated user to an enduser by clicking on add under Add Shared Identity Tab
To view shared identity navigate to View Shared Identity, you can click on Edit to edit Shared Identity.

How to manage apps?

Under Apps tab in Admin Console you can view the Apps and configure new SAML and Browser Plugin Apps.

Under View Apps tab you can see all details of Applications, edit them, delete them etc.
A new App can be configured by clicking on the Configure Apps button.
While configuring an app, you need to provide details depending on the type of app.
For SAML Apps, you need to provide ACS(Assertion Consumer Service) URL and also a set of attributes if necessary.
For Browser Plugin Apps, you need to provide a set of credentials or multiple sets of credentials for Individual Login and Shared Login respectively.

How to manage policies?

You can manage policies by adding a new policy and view the existing policies in Policies tab.

To add a policy go to Policies tab and select App authentication policy and then click on Add policy tab.
Select Application name from the dropdown.
Select a Group Name from dropdown - the group for which you want to add policy.
Give a policy name in Policy Name field.
Select the First Factor Type for authentication.
Enable Second Factor for authentication if required.
Click on Save button to add policy.
You can view policy, under View Policy tab of Policies -> App authentication policy

How to see users and policy mappings?

To see users and policy mappings, go to the Policies -> User Policy Mapping, select the Application and enter the username, see the policies mapped against the username typed in Username field.

How to integrate with any custom application?

To integrate with any custom application you can refer to Custom App Integration under Integration tab, follow the integration guide there to integrate any custom application.

How to deploy pre-integrated applications?

To deploy any pre integrated applications, please select any of the pre integrated apps (viz. Google Apps, Salesforce) from the Integration tab dropdown. Follow the integration guide to integrate the apps, diagram below depicts Google Apps Integration.

How to customize SMS gateways?

You can customize SMS gateways in the following way:

Select SMS Gateway Configuration from Customization tab.
Now select the radio button Set organization SMS Gateway.
Here enter the SMS Gateway URL.
To test the SMS gateway enter a phone number, on which you want to receive OTP.
Enter the OTP Sent in SMS to verify.
You can SAVE this configuration, over our default SMS configuration.

How to customize SMTP gateways?

Customize your SMTP gateway configuration under Customization -> SMTP Gateway Configuration.

Select the radio button Set Organization SMTP Server.
Fill in the Required field under Primary SMTP Server Configuration.
To test the SMTP configuration, enter the email to test.
Now enter the OTP received on your the email, you entered in the STEP1 field.
You can SAVE the configuration, over our default SMTP configuration.

How to customize OTP Email Template Configuration?

You can add your own customized email under Customization -> OTP Email Template Configuration. Select Set Customized Email Template, edit the fields as per your requirement. You can test your Email Template Configuration by clicking on Send Test Email. Click on SAVE to save this Email Configuration.

How to manage License?

To manage license, do the steps that follow:

Go to Manage License tab and click on Make Payment to do the payment.
Enter the payment details here.
Click on Pay and do the payment.

How to change password?

You can Change your password anytime you want, go to the Account tab and select Change Password.

How to configure Second factor?

Go to Strong Auth Method.
Select a second factor method from Second Factor Type to change the second factor method.
Check the checkbox Prompt for second factor during signin to your console
Click on Save to use this new 2 Factor Authentication Method.

How to edit account profile?

Edit your account profile under Account -> Personal Profile and edit your personal details and click on SAVE to save the account profile.

How to configure forgot phone options?

To set forgot phone configuration, go to Account tab and select Forgot Phone Configuration. Set the forgot phone configuration as per your choice, it is recommended to check alternate login method for security purposes.

What kind of reports are available?

You can see different types of reports available under reports tab viz.

High Level Usage Summary
Usage Summary By User
Detailed Usage Of All users
Single Sign On Summary
Active Users Summary
Fraud Prevention User Profiles
Fraud Prevention Summary