Hi Team,

We are testing ISAM 9 docker version. We want to use ISAM for OTP Generation and validation. We have noticed that MAC OTP is transnational OTP and does not require user registery for OTP Generation and validation.

Can someone please confirm if my assumption is correct and OTP Generation and validation does not need user registery?

Thanks,
Amitesh

------------------------------
Amitesh Singh
------------------------------

Hi Amitesh,

If you're asking "Can external users (not defined in ISAM user registry) register and receive OTPs" then the answer is yes.
Information for TOTP/HOTP/IBM Verify registration is stored in the HV Database - not in the registry.
For email/SMS OTP you'd have to pass in e-mail/SMS from somewhere (external user credential or some other lookup).

If you're asking "Can I use the Authentication functions of Access Manager without setting up a user registry" then that is a harder question.  I think the sensible answer is "no".  It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model.

If you need more clarity, please give your specific scenario.

Also worth noting that we have a cloud based solution which provides "Authentication-as-a-Service".  That would be Cloud Identity Verify.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Jon,

Thanks for your reply.
Yes, my question was "Can external users (not defined in ISAM user registry) register and receive OTPs", which you have already answered.
Regarding your comment
"It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model."

We would like to use ISAM AAC only for MAC OTP generation/validation tool, and want to use without reverse proxy, we have tested assigning some ip to runtime and accessing AAC runtime via REST API for OTP generation/validation. Do you think its not recommended way of doing and we must need to use reverse proxy? I don't want to use Reverse Proxy because it will give operational overhead and also we need to install/manage "user registry" (migrating mil of users to this registry would also be overhead). Please suggest.

Thanks,
Amitesh



------------------------------
Amitesh Singh
------------------------------

Original Message:
Sent: Mon July 01, 2019 06:33 AM
From: Jon Harry
Subject: ISAM9 Docker - OTP generation/validation

Hi Amitesh,

If you're asking "Can external users (not defined in ISAM user registry) register and receive OTPs" then the answer is yes.
Information for TOTP/HOTP/IBM Verify registration is stored in the HV Database - not in the registry.
For email/SMS OTP you'd have to pass in e-mail/SMS from somewhere (external user credential or some other lookup).

If you're asking "Can I use the Authentication functions of Access Manager without setting up a user registry" then that is a harder question.  I think the sensible answer is "no".  It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model.

If you need more clarity, please give your specific scenario.

Also worth noting that we have a cloud based solution which provides "Authentication-as-a-Service".  That would be Cloud Identity Verify.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

We always recommend that ISAM AAC be deployed behind the web reverse proxy as it turns out there will usually be some other use case for which it is necessary or highly desirable. This is also how you prevent unintentionally exposing other AAC services (using ISAM ACLs) to your network.  You can always authenticate or assert external users via EAI or oauth-auth to WRP to avoid have to migrate all users to an ISAM user registry.

That said, what you are doing will work. I just think it's better to have the WRP available and automate the deployment.

------------------------------
Shane Weeden
IBM
------------------------------

Original Message:
Sent: Mon July 01, 2019 08:18 PM
From: Amitesh Singh
Subject: ISAM9 Docker - OTP generation/validation

Hi Jon,

Thanks for your reply.
Yes, my question was "Can external users (not defined in ISAM user registry) register and receive OTPs", which you have already answered.
Regarding your comment
"It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model."

We would like to use ISAM AAC only for MAC OTP generation/validation tool, and want to use without reverse proxy, we have tested assigning some ip to runtime and accessing AAC runtime via REST API for OTP generation/validation. Do you think its not recommended way of doing and we must need to use reverse proxy? I don't want to use Reverse Proxy because it will give operational overhead and also we need to install/manage "user registry" (migrating mil of users to this registry would also be overhead). Please suggest.

Thanks,
Amitesh



------------------------------
Amitesh Singh
------------------------------


Original Message:
Sent: Mon July 01, 2019 06:33 AM
From: Jon Harry
Subject: ISAM9 Docker - OTP generation/validation

Hi Amitesh,

If you're asking "Can external users (not defined in ISAM user registry) register and receive OTPs" then the answer is yes.
Information for TOTP/HOTP/IBM Verify registration is stored in the HV Database - not in the registry.
For email/SMS OTP you'd have to pass in e-mail/SMS from somewhere (external user credential or some other lookup).

If you're asking "Can I use the Authentication functions of Access Manager without setting up a user registry" then that is a harder question.  I think the sensible answer is "no".  It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model.

If you need more clarity, please give your specific scenario.

Also worth noting that we have a cloud based solution which provides "Authentication-as-a-Service".  That would be Cloud Identity Verify.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Hi Shane,
Thanks for your reply and recommendation.


------------------------------
Amitesh Singh
------------------------------

Original Message:
Sent: Tue July 02, 2019 02:29 PM
From: Shane Weeden
Subject: ISAM9 Docker - OTP generation/validation

We always recommend that ISAM AAC be deployed behind the web reverse proxy as it turns out there will usually be some other use case for which it is necessary or highly desirable. This is also how you prevent unintentionally exposing other AAC services (using ISAM ACLs) to your network.  You can always authenticate or assert external users via EAI or oauth-auth to WRP to avoid have to migrate all users to an ISAM user registry.

That said, what you are doing will work. I just think it's better to have the WRP available and automate the deployment.

------------------------------
Shane Weeden
IBM
------------------------------


Original Message:
Sent: Mon July 01, 2019 08:18 PM
From: Amitesh Singh
Subject: ISAM9 Docker - OTP generation/validation

Hi Jon,

Thanks for your reply.
Yes, my question was "Can external users (not defined in ISAM user registry) register and receive OTPs", which you have already answered.
Regarding your comment
"It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model."

We would like to use ISAM AAC only for MAC OTP generation/validation tool, and want to use without reverse proxy, we have tested assigning some ip to runtime and accessing AAC runtime via REST API for OTP generation/validation. Do you think its not recommended way of doing and we must need to use reverse proxy? I don't want to use Reverse Proxy because it will give operational overhead and also we need to install/manage "user registry" (migrating mil of users to this registry would also be overhead). Please suggest.

Thanks,
Amitesh



------------------------------
Amitesh Singh


Original Message:
Sent: Mon July 01, 2019 06:33 AM
From: Jon Harry
Subject: ISAM9 Docker - OTP generation/validation

Hi Amitesh,

If you're asking "Can external users (not defined in ISAM user registry) register and receive OTPs" then the answer is yes.
Information for TOTP/HOTP/IBM Verify registration is stored in the HV Database - not in the registry.
For email/SMS OTP you'd have to pass in e-mail/SMS from somewhere (external user credential or some other lookup).

If you're asking "Can I use the Authentication functions of Access Manager without setting up a user registry" then that is a harder question.  I think the sensible answer is "no".  It might be possible to somehow use AAC without using Reverse Proxy (which needs user registry) but I don't think it would be a recommended and supported deployment model.

If you need more clarity, please give your specific scenario.

Also worth noting that we have a cloud based solution which provides "Authentication-as-a-Service".  That would be Cloud Identity Verify.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM