private boolean checkOTP(String otp,AMIdentity id,OathDeviceSettings settings) throws AuthLoginException {
  if (settings == null) {
    debug.error("OATH.checkOTP() : Invalid stored settings.");
    throw new AuthLoginException(amAuthOATH,"authFailed",null);
  }
  String secretKey=parseSecretKey(settings.getSharedSecret());
  if (minSecretKeyLength <= 0) {
    debug.error("OATH.checkOTP() : Min Secret Key Length is not a valid value");
    throw new AuthLoginException(amAuthOATH,"authFailed",null);
  }
  if (secretKey == null || secretKey.isEmpty()) {
    debug.error("OATH.checkOTP() : Secret key is not a valid value");
    throw new AuthLoginException(amAuthOATH,"authFailed",null);
  }
  if (secretKey.length() < minSecretKeyLength) {
    if (debug.errorEnabled()) {
      debug.error("OATH.checkOTP() : Secret key of length " + secretKey.length() + " is less than the minimum secret key length");
    }
    throw new AuthLoginException(amAuthOATH,"authFailed",null);
  }
  byte[] secretKeyBytes=DatatypeConverter.parseHexBinary(secretKey);
  if (passLen < 6) {
    debug.error("OATH.checkOTP() : Password length is smaller than 6");
    throw new AuthLoginException(amAuthOATH,"authFailed",null);
  }
  String otpGen;
  try {
    if (algorithm == HOTP) {
      int counter=settings.getCounter();
      for (int i=0; i <= windowSize; i++) {
        otpGen=HOTPAlgorithm.generateOTP(secretKeyBytes,counter + i,passLen,checksum,truncationOffset);
        if (isEqual(otpGen,otp)) {
          setCounterAttr(id,counter + i + 1,settings);
          return true;
        }
      }
    }
 else     if (algorithm == TOTP) {
      long lastLoginTimeStep=settings.getLastLogin() / totpTimeStep;
      if (lastLoginTimeStep < 0) {
        debug.error("OATH.checkOTP() : invalid login time value : ");
        throw new AuthLoginException(amAuthOATH,"authFailed",null);
      }
      if (totpTimeStep <= 0) {
        debug.error("OATH.checkOTP() : invalid TOTP time step interval : ");
        throw new AuthLoginException(amAuthOATH,"authFailed",null);
      }
      if (totpStepsInWindow < 0) {
        debug.error("OATH.checkOTP() : invalid TOTP steps in window value : ");
        throw new AuthLoginException(amAuthOATH,"authFailed",null);
      }
      long localTime=(time / totpTimeStep) + (settings.getClockDriftSeconds() / totpTimeStep);
      if (lastLoginTimeStep == localTime) {
        debug.error("OATH.checkOTP(): Login failed attempting to use the same OTP in same Time Step: " + localTime);
        return false;
      }
      boolean sameWindow=false;
      if (lastLoginTimeStep >= (localTime - totpStepsInWindow) && lastLoginTimeStep <= (localTime + totpStepsInWindow)) {
        if (debug.messageEnabled()) {
          debug.message("OATH.checkOTP() : Logging in in the same TOTP window");
        }
        sameWindow=true;
      }
      String passLenStr=Integer.toString(passLen);
      otpGen=TOTPAlgorithm.generateTOTP(secretKey,Long.toHexString(localTime),passLenStr);
      if (isEqual(otpGen,otp)) {
        return setLoginTime(id,localTime,settings);
      }
      for (int i=1; i <= totpStepsInWindow; i++) {
        long time1=localTime + i;
        long time2=localTime - i;
        otpGen=TOTPAlgorithm.generateTOTP(secretKey,Long.toHexString(time1),passLenStr);
        if (isEqual(otpGen,otp)) {
          return setLoginTime(id,time1,settings);
        }
        otpGen=TOTPAlgorithm.generateTOTP(secretKey,Long.toHexString(time2),passLenStr);
        if (isEqual(otpGen,otp) && sameWindow) {
          debug.error("OATH.checkOTP() : Logging in in the same window with a OTP that is older " + "than the current times OTP");
          return false;
        }
 else         if (isEqual(otpGen,otp) && !sameWindow) {
          return setLoginTime(id,time2,settings);
        }
      }
    }
 else {
      debug.error("OATH.checkOTP() : No OTP algorithm selected");
      throw new AuthLoginException(amAuthOATH,"authFailed",null);
    }
  }
 catch (  AuthLoginException e) {
    throw e;
  }
catch (  Exception e) {
    debug.error("OATH.checkOTP() : checkOTP process failed : ",e);
    throw new AuthLoginException(amAuthOATH,"authFailed",null);
  }
  return false;
}

private boolean checkOTP ( String otp , AMIdentity id , OathDeviceSettings settings ) throws AuthLoginException { if ( settings == null ) { debug . error ( "OATH.checkOTP() : Invalid stored settings." ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } String secretKey = parseSecretKey ( settings . getSharedSecret ( ) ) ; if ( minSecretKeyLength <= 0 ) { debug . error ( "OATH.checkOTP() : Min Secret Key Length is not a valid value" ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } if ( secretKey == null || secretKey . isEmpty ( ) ) { debug . error ( "OATH.checkOTP() : Secret key is not a valid value" ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } if ( secretKey . length ( ) < minSecretKeyLength ) { if ( debug . errorEnabled ( ) ) { debug . error ( "OATH.checkOTP() : Secret key of length " + secretKey . length ( ) + " is less than the minimum secret key length" ) ; } throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } byte [ ] secretKeyBytes = DatatypeConverter . parseHexBinary ( secretKey ) ; if ( passLen < 6 ) { debug . error ( "OATH.checkOTP() : Password length is smaller than 6" ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } String otpGen ; try { if ( algorithm == HOTP ) { int counter = settings . getCounter ( ) ; for ( int i = 0 ; i <= windowSize ; i ++ ) { otpGen = HOTPAlgorithm . generateOTP ( secretKeyBytes , counter + i , passLen , checksum , truncationOffset ) ; if ( isEqual ( otpGen , otp ) ) { setCounterAttr ( id , counter + i + 1 , settings ) ; return true ; } } } else if ( algorithm == TOTP ) { long lastLoginTimeStep = settings . getLastLogin ( ) / totpTimeStep ; if ( lastLoginTimeStep < 0 ) { debug . error ( "OATH.checkOTP() : invalid login time value : " ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } if ( totpTimeStep <= 0 ) { debug . error ( "OATH.checkOTP() : invalid TOTP time step interval : " ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } if ( totpStepsInWindow < 0 ) { debug . error ( "OATH.checkOTP() : invalid TOTP steps in window value : " ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } long localTime = ( time / totpTimeStep ) + ( settings . getClockDriftSeconds ( ) / totpTimeStep ) ; if ( lastLoginTimeStep == localTime ) { debug . error ( "OATH.checkOTP(): Login failed attempting to use the same OTP in same Time Step: " + localTime ) ; return false ; } boolean sameWindow = false ; if ( lastLoginTimeStep >= ( localTime - totpStepsInWindow ) && lastLoginTimeStep <= ( localTime + totpStepsInWindow ) ) { if ( debug . messageEnabled ( ) ) { debug . message ( "OATH.checkOTP() : Logging in in the same TOTP window" ) ; } sameWindow = true ; } String passLenStr = Integer . toString ( passLen ) ; otpGen = TOTPAlgorithm . generateTOTP ( secretKey , Long . toHexString ( localTime ) , passLenStr ) ; if ( isEqual ( otpGen , otp ) ) { return setLoginTime ( id , localTime , settings ) ; } for ( int i = 1 ; i <= totpStepsInWindow ; i ++ ) { long time1 = localTime + i ; long time2 = localTime - i ; otpGen = TOTPAlgorithm . generateTOTP ( secretKey , Long . toHexString ( time1 ) , passLenStr ) ; if ( isEqual ( otpGen , otp ) ) { return setLoginTime ( id , time1 , settings ) ; } otpGen = TOTPAlgorithm . generateTOTP ( secretKey , Long . toHexString ( time2 ) , passLenStr ) ; if ( isEqual ( otpGen , otp ) && sameWindow ) { debug . error ( "OATH.checkOTP() : Logging in in the same window with a OTP that is older " + "than the current times OTP" ) ; return false ; } else if ( isEqual ( otpGen , otp ) && ! sameWindow ) { return setLoginTime ( id , time2 , settings ) ; } } } else { debug . error ( "OATH.checkOTP() : No OTP algorithm selected" ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } } catch ( AuthLoginException e ) { throw e ; } catch ( Exception e ) { debug . error ( "OATH.checkOTP() : checkOTP process failed : " , e ) ; throw new AuthLoginException ( amAuthOATH , "authFailed" , null ) ; } return false ; }
checks the input otp .
