TOTP

What Is TOTP?

TOTP is the tab where the authenticator application (TOTP) enrollments of the users in a vService with the AGS access control enabled are listed and reset. Every row represents the TOTP enrollment a user makes for this vService and shows the identity of the user, their name, their email address, the creation time of the enrollment and the number of remaining backup codes.

The enrollment is formed when the user comes for the first time to the Multi-Factor Authentication (MFA) step with the TOTP method in the access flow and pairs the authenticator application with a QR code or (if Allow Manual Entry is on) by entering the secret key by hand. The enrollment is bound not to the MFA profile but to the vService: the same user makes a separate enrollment in two different AGS-enabled vServices. Settings such as the algorithm, the number of digits, the period and the backup code permission are defined in the MFA profile.

The screen answers the question "who is enrolled in TOTP, whose backup codes are used up?" and makes it possible for the enrollment of a user who loses their telephone or who has to install their application again to be reset. The secret key and the backup codes themselves are not brought to the screen under any condition; only the number of remaining backup codes is shown.

vService

Enrollment Scope

The enrollment is kept per vService; it is not bound to the MFA profile

5 Columns

A Single View

User ID · Username · Email · Enrolled At · Backup Codes (in a cluster additionally Source)

500

Limit

The maximum number of records read from every device

0 = Red

Backup Codes

A user who has no backup code is distinguished with a red and bold value

Reset TOTP

Deletes the Enrollment

The secret key and the backup codes are deleted together; the open sessions are not affected

Secret

The Key Is Not Shown

The secret key and the backup codes themselves are not brought to the screen

Cluster

A Single Combined List

The records of the two devices in a single list; the same user is displayed in a single row

Manual

Refresh

The list is not refreshed by itself; the current state is taken with Refresh

Accessing TOTP

1. Left Monitor Panel is opened.
2. AGS-Enabled vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 with AGS access control enabled are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.
5. On the screen that opens, the TOTP tab is clicked.

The tab is displayed unconditionally to the users who have monitoring authorization in the Load Balancer area. The records are listed with the Load Balancer view authorization; the Reset TOTP operation requires the Load Balancer modify authorization.

TOTP Listing Screen

When the TOTP tab is opened, the TOTP records belonging to the vService are listed in the form of a table. The list is fetched once when the screen is opened and is not refreshed by itself.

TOTP Listing Screen

The table opens with the following columns by default:

Column	Description
Source	The name of the device the record is found on. (Only in a cluster setup)
User ID	The identity of the user the record belongs to, determined during the authentication (e.g. the username or the email address).
Username	The username; if it is empty -.
Email	The email address of the user; if it is empty -.
Enrolled At	The date and time at which the user enrolled the authenticator application; if it is empty -.
Backup Codes	The number of remaining backup codes of the user. When the value is 0 it is written in red and bold; the value 0 covers together the record whose codes are used up, the record for which no backup code has been produced and the record made with a profile whose Allow Backup Codes is closed.

There is no column hidden by default. The rows are listed so that the newest record is at the top according to the enrollment date.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns will be shown in the table is selected; all of the columns come open. In the same panel the columns are reordered by being dragged and the alignment per column is selected; with the Fit rows to the page button the row height is fitted to the page, and with the Reset button the column layout is taken to the default. The layout is stored per user.

Limit

The maximum number of records to be read from the session store of every device is entered; the default is 500. In a cluster setup the limit is applied to every device separately. When the limit is reached the reading stops; which records stay outside is not bound to the enrollment date. The value is stored per user and is applied with the next Refresh.

Filter

Opens and closes the filter panel; the panel comes open by default. The filters are listed above the table in the form of a card strip and the number next to the card is the number of different values found for that criterion. The order of the cards is changed by being dragged and the selections made are stored. The filter criteria that can be used:

Filter	Description
User ID	The user identity; a search is made within the card.
Username	The username; a search is made within the card.
Email	The email address; a search is made within the card.
Backup Codes	The number of remaining backup codes; how many users every value is found in is shown with bars. 0 is selected in order to find the users who have no backup code.

In a cluster setup the Source card that shows the device the record is found on is added to these cards.

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Refresh

By clicking the Refresh button the TOTP records are fetched again from the session store with the current Limit value. Since the list is not refreshed by itself, the current state is taken with this button. While the fetching continues the button stays passive and shows a turning icon.

Reset TOTP

When one or more records are selected and the Reset TOTP button is clicked, the TOTP record of the selected users is deleted. Before the operation the "Are you sure?" confirmation is requested; while no row is selected the button is passive. The result of the operation is not reported separately; when at least one record is deleted the list is refreshed by itself. The same operation is found in the right-click menu and in the preview title as well.

WARNING

• The whole of the record, that is the secret key, the backup codes and the enrollment information, is deleted together; the operation is not undone. The codes the old record in the application of the user produces are no longer accepted and the user is expected to enroll their application again.
• In a cluster setup the deletion request is sent to both devices; if the other device cannot be reached at the moment the request is sent, the record is deleted only on this device and the operation is repeated later.
• The lockouts and the failed attempt counters of the user are not deleted; the lockout of a user who is locked is removed separately from the Lockout tab.
• The open sessions of the user are not ended; a user whose session is open continues to access as long as their session lasts. If the session has to be closed as well, the Revoke Session(s) operation on the Sessions tab is used.
• The operation is recorded on the User Logs screen on behalf of the user who performs the operation with the text <count> AGS TOTP enrollment(s) deleted for "<vService>" service and is displayed on the Log tab of the vService preview panel as well; it is not displayed on the Audit Logs tab.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp).

Column Based Search

Used to perform a column-based search on the information in the table.

Page Information

Contains information about the total number of fetched records and the range of records displayed in the list: Showing N-M of T records and the number of selected rows (N selected, Nothing selected while there is no selection). The total is not the number of all of the records in the session store but the number of the records fetched with the Limit.

Page Size

The maximum number of records to be displayed on the page is selected. The default is 100; the options are 50, 100, 250, 500 and All. The selection is not stored.

Right-Click Menu

When a row is right-clicked, a single-operation menu that has Actions written in its title is opened. The operation is applied only to the record right-clicked; the selection made in the list does not affect the menu.

Operation	What it does
Reset TOTP	Deletes the TOTP record of the user right-clicked; like the Reset TOTP in the toolbar, it requests the "Are you sure?" confirmation.

Preview of the Selected Record

When a row in the list is clicked, the preview of the record opens on the right of the screen. In the title there are the icon that shows the backup code state (in a user who has remaining backup codes a green user shield, and in a user who has no backup code a red shield) and the username, and if there is no username the email address or the user identity. If the email address is different from the username it is written separately below the title.

Preview of the Selected Record

Operations are performed on the record with the icon at the top right of the header:

Operation	What it does
Reset TOTP	Deletes the TOTP record of the previewed user; it requests the "Are you sure?" confirmation. While the list is being refreshed the icon stays passive.

The information rows in the panel are as follows in order:

Row	Description	Visibility condition
Source	The name of the device the record is found on.	A cluster setup
User ID	The identity of the user the record belongs to.	Always
Username	The username; if it is empty -.	Always
Email	The email address; if it is empty -.	Always
Enrolled At	The date and time at which the record was created; if it is empty -.	Always
Backup Codes	The number of remaining backup codes.	Always

Scope and Limits

INFO

• The TOTP settings are not made on this screen. The TOTP Issuer Name, TOTP Algorithm, TOTP Digits, TOTP Period, TOTP Window, Allow Manual Entry and Allow Backup Codes settings are defined in the Multi-Factor Authentication (MFA) profile.
• The records are kept per vService. When the record of a user is reset, only their record in this vService is deleted; the records of the user in the other AGS-enabled vServices are not affected.
• Deleting a user, a database or a profile does not delete the record. Deleting a user or a database on the Local Databases screen, deleting a profile on the Multi-Factor Authentication (MFA) screen and removing the AGS access from the vService do not touch the TOTP records; if it is necessary the record is reset from this tab or is deleted with Clean Storage on the Engine tab.
• In a cluster setup the records are kept per device and are not synchronized. The record of the user is found only on the device on which they make the enrollment; a user whose traffic passes to the other device may be asked to enroll again on that device. The screen combines the records of the two devices in a single list; if the same user has a record on both devices the list shows a single row and in that case Source, Enrolled At and Backup Codes belong to the record of only one of the devices. Reset TOTP deletes the record of the user on both devices together.
• The storage cleaning deletes the records as well. The Clean Storage operation on the Engine tab also deletes all of the TOTP records of this vService on the device it is applied to.
• The reading duration is limited. If the records cannot be fetched within 10 seconds the request ends; a warning is not displayed and the previous list stays in the table. In a cluster setup, if one of the devices cannot respond the list is formed only with the records of the other device.
• What the screen does not show. The secret key, the backup codes themselves, the last code usage time, which MFA profile the record was made with and the devices marked as trusted do not take place on this screen. The TOTP verification counters are monitored on the Live Stats and Dashboard tabs.