WSO2 Identity Server One-Time Password with external user store?

Question

A couple questions I couldn't find answers to with WSO2 Identity Server:

1. Is it possible to use the One-Time password feature with an external identity store? For example, I'm looking to enable this feature for users on an external user store accessed by SAML.

2. I noticed that with the "One-time password" feature of WSO2 enabled, it looks like the users "regular" password is disabled. Is there a way to allow the user to log in either using their normal password OR the one-time password? Or do they have to use the password emailed to them while this feature is enabled?

Answer 1

1. Yes. One time password will be handled and validated by Identity server itself. External user store is contacted to retrieve the userId and necessary claims only, in this case.
2. Yes. You can add two "Authenticators" in "Local & Outbound Authentication Configuration" > "Advanced Configurations" > "Step 1". Add "Basic" and "One-Time Password of your choice". Multi-Option Authentication describes the concept behind this.