Configuration of Mobile Authenticator Studio

To enable the integration of Mobile Authenticator Studio functionalities with OneSpan Cloud Authentication, the Mobile Authenticator Studio XML configuration file must be updated .

The procedures outlined in this section provide an overview of the configuration steps for a sample Mobile Authenticator Studio app with the following features enabled:

• Offline activation with user identifier

• Response-Only application

• Challenge/Response application

• Signature application

• Secure Channel

• Push Notification-based authentication

• Push Notification-based signature

For more detailed information about the customization options of Mobile Authenticator Studio, refer to the Mobile Authenticator Studio Customization Guide provided in the product package.

To configure Mobile Authenticator Studio for offline activation

1. Modify the default Activations element attributes and set the static vector associated to the Digipass license order. The static vector can be found in the static vector file (export.svf) delivered with the DIGIPASS export file (DPX).

   <Activations useUserIdentifier="true" splitPasswordInput="false" replaceInstance="false" activationIdForSecureChannelAction="multiDeviceOfflineActivation" staticVector="38080175010356...">

2. Modify the default MultiDeviceActivation element attributes as indicated below.

   <MultiDeviceActivation id="multiDeviceOfflineActivation">
     <MenuItem .../>
     <LicenseActivation>
       <OfflineLicenseActivation imageFormat="all" />
       <View>
          <Labels>
            <Label id="ReplaceInstanceConfirmationMessage" value="Do you want to overwrite your Digipass instance?"/>
          </Labels>
          <Errors>
            <Error id="CameraMandatory" value="A usable camera is mandatory to run this application."/>
            <Error id="ReplaceInstanceNotPermitted" value="You cannot replace the Digipass instance"/>
            <Error id="MultiInstanceNotPermitted" value="You cannot load another Digipass instance."/>
          </Errors>
       </View>
     </LicenseActivation>
     <InstanceActivation>
       <OfflineInstanceActivation imageFormat="all" />
       <View>
          <Labels>
            <Label id="MultiDeviceLicenseActivationSuccess" value="You have preactivated your license. Please find below your device code. Once entered on the server side, press Scan to continue."/>
            <Label id="MultiDeviceLicenseActivationScanImageMessage" value="Press the button below to scan your online image."/>
          </Labels>
          <Dynamics>
            <Dynamic id="DeviceCode" class="resultGenerated"/>
          </Dynamics>
          <Buttons>
            <Button id="Next" value="Scan online image"/>
          </Buttons>
       </View>
     </InstanceActivation>
     <ExtraActivationData>
       <View>
          <Fields>
            <Field id="CreatePassword" name="Local password" comment="Create your Digipass local password." class="inputText"/>
            <Field id="CreatePasswordConfirmation" name="Confirmation password" comment="Enter your confirmation password." class="inputText"/>
            <Field id="VerifyPassword" name="Local password" comment="Enter your Digipass local password." class="inputText"/>
            <Field id="UserIdentifier" name="User identifier" comment="Enter your user identifier." class="inputText"/>
          </Fields>
          <Errors>
            <Error id="UserIdentifierEmpty" value="You must enter a user identifier."/>
            <Error id="ConfirmationPasswordIncorrect" value="The confirmation password does not match the password."/>
          </Errors>
       </View>
     </ExtraActivationData>
     <PostActivation cryptoAppIndex="4">
       <OfflinePostActivation displaySerialNumber="true" responsePattern="XXXXXX" hostCodePattern="XXXXXX" centered="true" />
       <View title="Token derivation">
          <Fields>
            <Field id="Challenge" name="Challenge" comment="Enter the challenge." class="inputText"/>
          </Fields>
          <Labels>
            <Label id="ClipboardCopyHostCode" value="Server response copied to clipboard"/>
            <Label id="ClipboardCopyResponse" value="First OTP copied to clipboard"/>
            <Label id="OnlineServerActivationWaitMessage" value="Activation confirmation, please wait..."/>
            <Label id="ResultHostCode" value="Server host code:" class="resultText"/>
            <Label id="ResultResponse" value="Your first OTP is:" class="resultText"/>
            <Label id="SerialNumber" value="Your serial number:" class="resultText"/>
          </Labels>
          <Dynamics>
            <Dynamic id="ResultHostCode" class="resultGenerated"/>
            <Dynamic id="ResultResponse" class="resultGenerated"/>
            <Dynamic id="SerialNumber" class="resultGenerated"/>
          </Dynamics>
          <Errors>
            <Error id="ChallengeEmpty" value="The activation response does not include a challenge."/>
            <Error id="ChallengeTooShort" value="The minimal length for the challenge is %_MinLength_%."/>
            <Error id="ChallengeTooLong" value="The maximum length of the challenge is %_MaxLength_%."/>
          </Errors>
       /View>
     </PostActivation>
   </MultiDeviceActivation>

   The cryptoAppIndex attribute of the PostActivation element must define the Digipass cryptographic application used for Secure Channel.

To configure Mobile Authenticator Studio for Push Notification workflows

1. Set up the URL of the sandbox environment to register user devices to receive Push Notification messages: add a NotificationRegistration block to the Notifications element.

   <Notifications>
     <NotificationRegistration>
       <URL method="POST" contentType="json" value="https://tenant.env.tid.onespan.cloud/v1/mobile-commands/notification/push/updateNotificationID">
          <PayloadParameter key="userID" value="%_UserIdentifier_%"/>
          <PayloadParameter key="domain" value="%_Domain_%"/>
         <PayloadParameter key="digipassInstanceID" value="%_SerialNumber_%-%_SequenceNumber_%"/>
         <PayloadParameter key="encryptedNotificationID" value="%_VascoNotificationIdentifier_%"/>
       </URL>
     </NotificationRegistration>
   ...
   </Notifications>

2. Set up the URLs of the sandbox environment required for Push Notification-based authentication: add a SecureChannelAction block to the NotificationsList element.

   The identifier of the relevant block is related to the message type and has the value 03.

   <Notifications>
     <NotificationsList>
     <!-- Secure channel Action with push and login -->
       <SecureChannelAction id="03">
         <SecureChannelDetails>
           <URL method="POST" contentType="json" value="https://tenant.env.tid.onespan.cloud/v1/mobile-commands/authentication/push/getPreparedSecureChallenge">
             <PayloadParameter key="serialNumber" value="%_SerialNumber_%-%_SequenceNumber_%"/>
             <PayloadParameter key="challengeKey" value="%_Challenge_%"/>
           </URL>
         </SecureChannelDetails>
         <SecureChannelValidation>
           <URL method="POST" contentType="json" value="https://tenant.env.tid.onespan.cloud/v1/mobile-commands/authentication/push/authUser">
             <PayloadParameter key="userID" value="%_UserIdentifier_%"/>
             <PayloadParameter key="domain" value="%_Domain_%"/>
             <PayloadParameter key="challengeKey" value="%_Challenge_%"/>
             <PayloadParameter key="signature" value="%_OTP_%"/>
           </URL>
         </SecureChannelValidation>
         <SecureChannelRejection>
           <URL method="POST" contentType="json" value="https://tenant.env.tid.onespan.cloud/v1/mobile-commands/authentication/push/cancelAuthUser">
             <PayloadParameter key="serialNumber" value="%_SerialNumber_%-%_SequenceNumber_%"/>
             <PayloadParameter key="challengeKey" value="%_Challenge_%"/>
           </URL>
         </SecureChannelRejection>
         <View title="Login Request">
         <Labels>
            <Label id="TransactionAcceptRejectMessage" value="Do you want to log in to ‘%_ServiceName_%’ as %_UserIdentifier_%?"/>
            <Label id="DetailsWaitMessage" value="Fetching login request" />
            <Label id="RejectionWaitMessage" value="Rejecting login ..." />
            <Label id="ValidationWaitMessage" value="Accepting login..." />
          </Labels>
          <Buttons>
            <Button id="Accept" value="Accept"/>
            <Button id="Deny" value="Reject"/>
          </Buttons>
       </View>
       </SecureChannelAction>
     </NotificationsList>
   </Notifications>

3. Set up the URLs of the sandbox environment required for the Push Notification-based transaction data signing workflow: add a SecureChannelAction block to the NotificationsList element.

   The identifier of the relevant block is related to the message type and has the value 05.

   <NotificationsList>
       <!-- Secure channel Action with push and sign -->
       <SecureChannelAction id="05">
         <SecureChannelDetails>
           <URL method="POST" contentType="json" value="https://<tenant>.<env>.tid.onespan.cloud/v1/mobile-commands/signature/push/getPreparedSignatureRequest">
             <PayloadParameter key="serialNumber" value="%_SerialNumber_%-%_SequenceNumber_%">
             PayloadParameter key="requestKey" value="%_Challenge_%"/>
           </URL>
         </SecureChannelDetails>
         <SecureChannelValidation>
           <URL method="POST" contentType="json" value="https://<tenant>.<env>.tid.onespan.cloud/v1/mobile-commands/signature/push/authSignature">
             <PayloadParameter key="userID" value="%_UserIdentifier_%">
             <PayloadParameter key="domain" value="%_Domain_%"/>
             <PayloadParameter key="requestKey" value="%_Challenge_%"/>
             <PayloadParameter key="signature" value="%_OTP_%"/>
           </URL>
         </SecureChannelValidation>
         <SecureChannelRejection>
           <URL method="POST" contentType="json" value="https:/<tenant>.<env>.tid.onespan.cloud/v1/mobile-commands/signature/push/cancelAuthSignatureRequest">
             <PayloadParameter key="serialNumber" value="%_SerialNumber_%-%_SequenceNumber_%"/>
             <PayloadParameter key="requestKey" value="%_Challenge_%"/>
           </URL>
         </SecureChannelRejection>
         <View title="Transaction Request">
           <Labels>
             <Label id="TransactionAcceptRejectMessage" value="\Do you want to accept this transaction as %_UserIdentifier_%?"class="infoLabel"/>
             <Label id="DetailsWaitMessage" value="Fetching transaction request" />
             <Label id="RejectionWaitMessage" value="Rejecting transaction..." />
             <Label id="ValidationWaitMessage" value="Accepting transaction..." />
           </Labels>
           <Dynamics>
             <Dynamic id="Title" class="titleItem"/>
             <Dynamic id="Keys" class="keyItem"/>
             <Dynamic id="Values" class="valueItem"/>
             <Dynamic id="FreeText" class="freeTextItem"/>
           </Dynamics>
           <Buttons>
             <Button id="Accept" value="Accept"/>
             <Button id="Deny" value="Reject"/>
           </Buttons>
         </View>
       </SecureChannelAction>
     </NotificationsList>
   </Notifications>