Share on:

How to Setup 2FA with Google Authenticator in OpenAM

Original article:


Google Authenticator is one of the most commonly used applications for two-factor authentication (2FA). It runs both on Android and iOS devices. In the following article, we will describe how to set up 2FA in OpenAM with Google Authenticator.

OpenAM Setup

Setup Authentication Module

For example, we have realm staff where we want to set up 2FA with Google Authenticator. Login into admin console as amadmin user, go to realm staff, and create new OATH module google-authenticator with the following settings:

New Google Authenticator Module

Google Authenticator Module Settings

There are some important settings:

Setup Authentication Chain

By default, there is ldapService authentication chain, which uses only DataStore authentication module. Add google-authenticator module in the chain.

Authentication Chain

Setup User Accounts

The next part would be a little bit tricky. To authenticate in Google Authenticator we need to set up user accounts first. Then generate for each user account shared secret. As an example, we will take test account and for this account shared secret will be s3cr3tw0rd.

Encode into Base16. You can or use online service either use the following Java function:

private String toBase16(String str) {
  return String.format("%x", new BigInteger(1, str.getBytes(Charset.defaultCharset())));

Base16 encoded value is 73336372337477307264.

Open User account properties in Apache Directory Studio (or any other LDAP client application) and add sunIdentityServerPPEncryptKey value 73336372337477307264 as shown on the picture below.

Apache DS User Properties

Then generate a QR code to register the user in the Google Authenticator application. QR for Google Authenticator is URI in the following format otpauth://totp/<account id>@<issuer>?secret=<base32 encoded secret>&issuer=<Issuer Name>

Encode secret as Base32. You can use or online service, ether following Java function:

import org.apache.commons.codec.binary.Base32;

private String toBase32(String str) {
	return new Base32().encodeAsString(str.getBytes());

Base32 encoded value is OMZWG4RTOR3TA4TE

The final URI will be: otpauth://totp/

Let’s use the online service to generate a QR code image:

Google Authenticator QR Code

Scan QR in Google Authenticator application. A new account will be added.

Test Solution

Let’s sign in into realm staff с with test account: Auth Staff Login Password You will be prompted for OTP from Google Authenticator.

Auth Staff OTP 2FA

Enter the code from Google Authenticator, and you will be successfully authenticated.