# OpenAM Administration Guide
2.2. Configuring Authentication Modules

Sidebar | Prev | Up | Next

### 2.2.9. Hints For the HOTP Authentication Module

The HMAC One-Time Password authentication module works together with the Data Store module to retrieve a user's mail address or telephone number to send a one-time password to complete authentication.

To use HOTP you set up an authentication chain with the Data Store module as the `requisite` first module, and the HOTP module as the second `requisite` module. When authentication succeeds against the Data Store module, OpenAM passes the Email Address and Telephone Number attributes from the user profile to the HOTP module. For the HOTP module to use either attribute, the Email Address must contain a valid email address, or the Telephone Number must contain a valid SMS telephone number.

You can set the HOTP module to automatically generate a password when users begin logging into the system. You can also setup a mobile phone, mobile carrier, and email attributes for tighter controls over where the messages are generated and what provider the messages go through to reach the user.

ssoadm service name: `sunAMAuthHOTPService`

Authentication Level

  Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

  ssoadm attribute: `sunAMAuthHOTPAuthLevel`

SMS Gateway Implementation Class

  Change this if you must customize the SMS gateway implementation. The default class sends an SMS or email, depending on the configuration.

  ssoadm attribute: `sunAMAuthHOTPSMSGatewayImplClassName`

Mail Server Host Name

  Host name of the mail server supporting Simple Message Transfer Protocol for electronic mail.

  ssoadm attribute: `sunAMAuthHOTPSMTPHostName`

Mail Server Host Port

  The default outgoing mail server port is 25, 465 (when connecting over SSL).

  ssoadm attribute: `sunAMAuthHOTPSMTPHostPort`

Mail Server Authentication Username

  User name for OpenAM to connect to the mail server.

  ssoadm attribute: `sunAMAuthHOTPSMTPUserName`

Mail Server Authentication Password

  Password for OpenAM to connect to the mail server.

  ssoadm attribute: `sunAMAuthHOTPSMTPUserPassword`

Mail Server Secure Connection

  If OpenAM connects to the mail server securely, OpenAM must be able to trust the server certificate.

  ssoadm attribute: `sunAMAuthHOTPSMTPSSLEnabled`

Email From Address

  The `From:` address when sending a one-time password by mail.

  ssoadm attribute: `sunAMAuthHOTPSMTPFromAddress`

One Time Password Validity Length (in minutes)

  One-time passwords are valid for 5 minutes after they are generated by default.

  ssoadm attribute: `sunAMAuthHOTPPasswordValidityDuration`

One Time Password Length (in digits)

  Set the length of the one-time password to 6 or 8 digits.

  ssoadm attribute: `sunAMAuthHOTPPasswordLength`

One Time Password Delivery

  Send the one-time password by SMS, by mail, or both.

  ssoadm attribute: `sunAMAuthHOTPasswordDelivery`

Mobile Phone Number Attribute Names

  Provides the attribute name used for the text message. The default value is `telephoneNumber`.

  ssoadm attribute: `openamTelephoneAttribute`

Mobile Carrier Attribute Name

  Provides the name of the carrier that will send the text message.

  Every carrier has their own attribute name ending, for example Verizon uses @vtext.com or vtext.com. Contact your mobile carrier to find out what their attribute name is. If you will be sending international texts, ask your carrier if a country code is a required.

  ssoadm attribute: `openamSMSCarrierAttribute`

Email Attribute Name

  Provides the attribute name used to email the OTP. The default value is `mail` (email).

  ssoadm attribute: `openamEmailAttribute`

Auto Send OTP Code

  Setup the HOTP module to automatically generate an email or text message when users begin the login process.

  ssoadm attribute: `sunAMAuthHOTPAutoClicking`