Overview

This module is designed to help you generate OTPs with full flexibility and customization – perfect for applications that require secure user interactions.

✨ Designing a Flexible and Configurable OTP Solution

Built with Mendix and Java, this solution provides a robust OTP generation and validation mechanism, giving you complete control over security policies and user experience.

🔧 Key Features & How It Works:

• Service-Level Configuration: Define security policies for each service, including:🔑 Maximum unverified attempts per OTP🔑 Maximum OTP generations per session⏳ Automatic blocking after exceeding failed attempts🕒 Configurable OTP expiration time

• Resend Functionality: Allow users to request OTP resends with a configurable limit on resend and generation attempts.

This module empowers Mendix developers to build secure, scalable, and customizable OTP workflows with ease.

Documentation

Mendix-OTPGeneration

This module to help you in generating OTP with full customization 𝗗𝗲𝘀𝗶𝗴𝗻𝗶𝗻𝗴 𝗮 𝗙𝗹𝗲𝘅𝗶𝗯𝗹𝗲 𝗮𝗻𝗱 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝗯𝗹𝗲 OTP

This solution implements a OTP generation and validation solution designed to enhance security for user interactions. The system is built using Mendix and Java and includes the following key functionalities:

Here’s how it works:

✨ Designing a Flexible and Configurable OTP Solution

Built with Mendix and Java, this solution provides a robust OTP generation and validation mechanism, giving you complete control over security policies and user experience.

🔧 Key Features & How It Works:

• Service-Level Configuration: Define security policies for each service, including:

• 🔑 Maximum unverified attempts per OTP

• 🔑 Maximum OTP generations per session

• ⏳ Automatic blocking after exceeding failed attempts

• 🕒 Configurable OTP expiration time

• Resend Functionality: Allow users to request OTP resends with a configurable limit on resend and generation attempts.

Custom OTP Configurations: Services are linked to specific OTP configurations, which define:

🔢 Whether the OTP contains letters, numbers, or both.

1- OTP Storage and Validation: OTP data is stored in the internal database. A unique session identifier is used to associate OTP with users. Validation ensures user-entered text matches the stored OTP.

2- Security Measures: OTP values are hashed before storage. Validation uses Mendix’s MendixHashString library for secure string comparison. Configurable maximum attempts before OTP expiration or refresh. Java Action: (verifyOTP)

Purpose

This Java action validates the user-entered OTP string against the hashed value stored in the database. Key Logic

#Retrieve the stored OTP object using the session identifier and transaction ID.

#Use the MendixHashString.verifyValue method to securely compare the stored hash with the user input.

#Return true if the validation succeeds, false otherwise.

Installation:

Download the Module Add the module to your project.

Assign Roles Map your project's user roles to the module roles provided: Administrator and User.

Access the Admin Page Open the OTPConfig_Overview page through your admin navigation or directly.

Run Your Application You’re all set to get started! Configuration

Define OTPConfig Settings Configure general OTP settings, such as the length of the OTP, inclusion of letters, numbers, and other rules.

Adjust System or Service Rules Configure your system’s behavior based on your use case by referring to the placeholders and documentation provided for each attribute. (Most attributes have detailed annotations to guide you.)

Generate OTP Refer to EX_OTP_User for an example of OTP generation. then you can use the OTP and send your sms , email , etc (This logic will be created by you)

Verify OTP Use either ACT_OTPVerification_Verify or ACT_OTP_Verify microflows. To customize: Duplicate the microflow in your own module. Read the annotations for guidance. Maintain the core verification logic, but you can tweak responses for failed or invalid inputs based on your specific requirements. Support

If you have any questions, feedback, or require assistance, feel free to reach out:

LinkedIn:(https://www.linkedin.com/in/mohamedelnady27/) Email: mohamed.k.elnady@gmail.com Enjoy and Happy Developing!