Authentication Server

Authentication Server
One Time Password
Hardware Tokens
Software Tokens


OpenOTP™ is an enterprise-grade user authentication solution based on open standards. OpenOTP provides many (highly configurable) authentication schemes for your Domain users. It supports the combinations of signle-factor and multi-factor user access with One-Time Password technologies (OTP) and Universal Second Factor (FIDO-U2F). 

Product description

OpenOTP™ Server (Multi-Factor with OTP and FIDO-U2F)

OpenOTP™ is an enterprise-grade user authentication solution based on open standards. OpenOTP provides many (highly configurable) authentication schemes for your Domain users. It supports the combinations of signle-factor and multi-factor user access with One-Time Password technologies (OTP) and Universal Second Factor (FIDO-U2F). 

The OpenOTP solution is composed of several components including WebADM sever, OpenOTP RADIUS Bridge and Self-Service applications. Combined with RCDevs third-party integrations, OpenOTP supports VPNs, Citrix, Web SSO, ADFS, Linux, Microsoft, Wifi, Web applications and much more…

OpenOTP is already used by thousands of customers in more than 40 countries, including fortune 100 companies. The fast market adoption of OpenOTP is the result of a high-quality product design, an impressive set of features, an increasing panel of integrations and an unbeatable combination of cost-efficiency, security and easy of use to secure corporate access.


RCDevs’ Multi-Factor Authentication relies on One-Time Password Technologies (OTP) and FIDO Universal Second Factor (U2F):


OATH Event, Time and Challenge -based


OATH Event, Time and Challenge -based


FIDO Universal Second Factor (U2F)


YubiKey Standard, Nano, FIDO


Mobile-OTP (mOTP) Software Tokens


SMS OTP (On-Demand and Prefetched)


Mail and Secure Mail OTP (PIN Mailer)


Printed OATH One-Time Password Lists

Supported Mobile Devices (Software Tokens)

OpenOTP supports multiple One-Time Password standards (OATH HOTP/TOTP/OCRA, Mobile-OTP, YubiKey, SMSOTP or MailOTP). Software Tokens are provided by various publishers for any mobile platform such as:

Google Android

Apple iPhone, iPad

Windows Mobile, Blackberry, Palm

Java Phones (J2ME)

Certified Hardware Tokens

OpenOTP supports a large variety of OATH Hardware Tokens from many Token manufacturers. In fact, any Token working in OATH HOTP/TOTP or OCRA mode is compatible.

RCDevs RC200

Feitian c100 | c200

SecuTech 300 | 500

SmartDisplayer e1010 | t1020 | e2010

Vasco Digipass GO6 | GO3

Yubikey Standard | Neo | U2F


OpenOTP provides interfaces including SOAP, REST, JSON-RPC and RADIUS. The native SOAP API is extremely simple and is provided with a WSDL service description file. It is also very easy to implement OpenOTP One-Time Password and/or U2F functionalities into your existing Web applications. Additional integration software from RCDevs provide support for Windows, ADFS, Linux and even Wifi access. 

You can use OpenOTP with:  

  • Web Applications (Java, PHP, ASP, Python, .Net…)
  • VPNs and SSL-VPNs (Checkpoint, Cisco, Nortel, Juniper, F5, Palo-Alto…)
  • OpenVPN Variants and PFsense
  • Citrix Access Gateway & Web Interface
  • Microsoft Reverse-Proxies (TMG / UAG / 2012 Server)
  • Microsoft ADFS (Exchange, Sharepoint…)
  • Linux PAM (SSH, FTP, OpenVPN, PPTP, POP/IMAP…)
  • Windows Login (Credential Provider for Vista, 7, 8)
  • Web Products (SugarCRM, Joomla, WordPress, RoundCube, Magento…)
  • OpenID-enabled Web Sites (Livejournal, Sourceforge…)
  • Corporate SAML and Google Apps
  • Cloud Applications (SalesForce, SugarCRM, GoToMeeting…) 
  • Enterprise Wifi Access (with EAP-GTC and EAP-TTLS-PAP)
  • Amazon Elastic Compute Cloud (EC2 / AWS)
  • Any other system (Using our simple integration libraries)




Application Passwords

Application passwords are long random keys which can be generated by the users in the Self-Services and are specific to a client application. These keys can be used as replacement to the default login when the application does not support OTP nor U2F. The typical use-case is a mail server which is accessed via mobile devices. The mail clients on the devices are configured with the mail server application’s password to avoid entering the OTP password at every connection.

Contextual authentication

OpenOTP contextual authentication is able to intelligently lower the security requirement for a user login when a trusted context is validated. The trusted login context relies on the user’s IP addresses combined with client device fingerprints. When a login context is trusted, the user logs in with the single factor (the domain password). If a login failure occurs, multi-factor is enforced again.

QRCode Key Provisioning

With OpenOTP QRCode key provisioning, Token self-registration has never been so easy. No manual Token configuration or secret key input is required: With Google Authenticator or FreeOTP, users register their Software Token simply by scanning a registration QRCode on their iPhone or Android mobile device. With other Software Tokens, users simply scan the displayed Token Key with a barcode reader and copy/paste it to their Token key for registration.

OpenOTP WebApps

Software Token technologies require the end-user to download the mobile software, enroll the mobile Token on the authentication server, and sometime to resynchronize the OTP generator. OpenOTP includes end-user Web Applications (SelfDesk and SelfReg) for simplifying the deployment of your solution as much as possible. RCDevs’ Self Services provides self-management end-user portals to be published on your corporate or public network.


  • RCDevs SelfDesk allows end-users to self-configure some personal settings, update their account information (ex. mobile number or email address), download, register and resync their Software Tokens.
  • SelfReg is another WebApp where administrators can trigger a user email with a one-time self-registration URL. By clicking the URL and entering his password, the user can register, resync and test Tokens.
  • PwReset allows users to securely reset their lost or expired Domain passwords with Token / SMS OTP, PKI and even U2F

Hardware Security Modules

OpenOTP complies with the highest security requirements by supporting Hardware Security Modules (HSM). The YubiHSM hardware modules from Yubico ( can be used in order to enforce hardware cryptography in OpenOTP with AES encryption of Token seeds and true random generation for SMS/Email OTPs, OCRA challenges, OTP lists.

The use of HSM modules in OpenOTP is 100% transparent and the migration to hardware cryptography can be done at any time without impacting your business. RCDevs WebADM server supports up to 8 HSM modules in hot-plug mode for fault-tolerance and increased performances.

OpenOTP Trusted Domains

Trusts are special Domains which do not correspond to a set of local LDAP users but a set of users on a remote OpenOTP installation. The Trust system works like an authentication proxy for remote domains (within a trusted organization) and maps a local virtual Domain name to a remote Domain on another WebADM server.

Help the seller understand how this product meets your needs
Contact name
352 54 55 80 580
Esch-sur-Alzette, Luxembourg