IBM Verify

 View Only

 Update sender email address in ISVA OTPDeliver mapping rule

Tricia McLaughlin's profile image
Tricia McLaughlin posted Wed October 08, 2025 10:39 AM

Hello TechXchange Group,

 

We use one-time passwords in ISVA (v10.0.8) to implement additional verification for certain application functionality (e.g., access the User Security screen).  We use the MAC One-time Password AAC authentication mechanism and pass the user's email address in the request because the application is the system of record for email addresses (not ideal, but the application predates our use of IDM by many, many years).  We are implementing this strategy for another part of the application and the business requirements dictate using a different email template and sender email address.  I implemented the "different template" by configuring a new policy (email template configured as part of the policy), however the sender email address is specified in the Email message mechanism which is common to all policies that use the MAC One-time Password mechanism.

 

Is it possible to change the sender email address in the OTPDeliver mapping rule?  I can determine when I want to change it, but I have not figured out how to do it (this bit of code is nested in the if otpType.equals("mac_otp") block and this policy is only used to send email - no SMS):

 

    var policyId = stsuuCtxAttrs.getAttributeValueByNameAndType("PolicyId", "otp.user.type");
    if (policyId.equals("urn:ibm:security:authentication:asf:baas")) {
        IDMappingExtUtils.traceString("DEBUG: OTPDeliver - update SenderEmail for PolicyId " + policyId);
        // How do I update the sender email address?
    }

 

I see a dump of the com.tivoli.am.fim.otp.deliveries.email.EmailOTPConfiguration in the trace output, including a line with getSenderEmail Used SenderEmail: xxxx@yyyy.zzz.  Is there a way to set the SenderEmail value or create/replace the EmailOTPConfiguration (with a different SenderEmail address)?  If not, is there a different way to accomplish the same thing as the MAC One-time Password mechanism (including getting the email address from the request)?

 

 

Regards,

Chip

Shane Weeden's profile image
Shane Weeden posted Thu October 09, 2025 01:05 AM

I don't believe you can do this with MacOTP, however I think you probably could (I haven't tried, just speculating) if you wrote a custom AAC policy that managed the OTP portion yourself and leveraged your own instance of the "Email Message" mechanism. On the Mechanisms panel you can create a new "Email message" mechanism, just like you create an Infomap. A preceeding infomap would setup all the email message that you wanted to send. You'd obviously then also have to write a subsequent Infomap that prompted for and validated the OTP. A little bit more involved than using the OOTB MacOTP policy, but I think this will give you the flexibility you are looking for.

Related Content