> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/integrity-radius/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/integrity-radius/authenticators/username-password-and-otp.md).

# Username, Password & OTP

Username, password and one-time password authentication.

RADIUS challenge response authentication. 

The RADIUS client sends an Access Request which includes the username and password. The Fortified Integrity RADIUS server responds with an Access Challenge (if the credentials have authenticated successfully). The client then sends a second Access Request with the one-time password, and the server responds with either an Access Accept or Access Reject.

Configurable response messages can be used to further authorization on the client side.

## Configuration

{% hint style="info" %}
**RADIUS Authenticator Type:** `UsernamePasswordOTP | RadiusUsernamePasswordOTP`
{% endhint %}

{% hint style="success" %}
Common authenticator properties can be found in the [common configuration section](/integrity-radius/authenticators/common-configuration.md).
{% endhint %}

{% tabs %}
{% tab title="Properties" %}

<table><thead><tr><th width="281">Name</th><th width="255">Description</th><th width="151">Default value</th><th width="132" data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>pipe</code></td><td>Username, password validation pipe id.</td><td>N/A</td><td>true</td></tr><tr><td><code>otp_pipe</code></td><td>One-time password validation pipe id.</td><td>N/A</td><td>true</td></tr><tr><td><code>retry_challenge_message</code></td><td>Retry challenge message, commonly used when  OTP retry is configured.</td><td></td><td>false</td></tr><tr><td><code>proceed_on_error</code></td><td>Always send Access-Challenge to client. If username and password validation fails for the first request, a reject message will be sent for the second (OTP) request.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>impersonation_check</code></td><td>Ensures that the username is the same for both username and password request and one-time password request.</td><td><code>true</code></td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{  
    "id": "auth01",  
    "type": "UsernamePasswordOTP",  
    "config": {    
        "selector": {      
            "host": ".*",      
            "attrs": [        
                {                    
                    "type": 44,          
                    "value": "sms"        
                }      
            ]    
        },    
        "accept_response_attrs": [      
            {        
                "type": 33,        
                "operation": "COPY"      
            }    
        ],    
        "reject_response_attrs": [      
            {        
                "type": 18,        
                "name": "Reply-Message",        
                "value": "Sorry {{{request.User-Name}}}!"      
            }    
        ],    
        "challenge_response_attrs": [      
            {        
                "type": 18,        
                "name": "Reply-Message",        
                "value": "Please enter your one-time password!",        
                "operation": "CREATE"      
            },      
            {        
                "type": 33,        
                "operation": "COPY"      
            }    
        ],    
        "pipe": "uidpwdpipe",
        "otp_pipe": "otppipe",
        "retry_challenge_message" : "Please enter your one-time password",
        "proceed_on_error": false,    
        "impersonation_check": true  
    }
}
```

{% endtab %}
{% endtabs %}

## Logging

Apart from system logging, event logging is done when an authentication is complete.

Event ids are:

* RAD\_000100, Authentication success using username and passWord
  * IDENTIFIER (user trace id)
  * DESTINATION\_USER\_NAME (username from incoming request)
  * SOURCE\_ADDRESS (ip address of device starting transaction)
  * CUSTOMER\_IDENTIFIER (if configured)
  * TRANSPORT\_PROTOCOL (RADIUS)
* RAD\_000101, Authentication failure using username and passWord
  * IDENTIFIER (user trace id)
  * DESTINATION\_USER\_NAME (username from incoming request)
  * SOURCE\_ADDRESS (ip address of device starting transaction)
  * CUSTOMER\_IDENTIFIER (if configured)
  * TRANSPORT\_PROTOCOL (RADIUS)
* RAD\_000103, Authentication failure using username, passWord & OTP
  * IDENTIFIER (user trace id)
  * DESTINATION\_USER\_NAME (username from incoming request)
  * SOURCE\_ADDRESS (ip address of device starting transaction)
  * CUSTOMER\_IDENTIFIER (if configured)
  * TRANSPORT\_PROTOCOL (RADIUS)
* RAD\_000104, Authentication failure using username and passWord, safe mode enabled, sending Access Challenge
  * IDENTIFIER (user trace id)
  * DESTINATION\_USER\_NAME (username from incoming request)
  * SOURCE\_ADDRESS (ip address of device starting transaction)
  * CUSTOMER\_IDENTIFIER (if configured)
  * TRANSPORT\_PROTOCOL (RADIUS)

## Data sent to PIPE

All RADIUS request data as `strings` with attribute name as key.