Declarative techniques for transaction-specific authentication

An access manager server, comprising:

• one or more hardware processors;
• and
• memory storing instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:
• receive information for a transaction, the transaction requested by a user of a client device and to be performed by an application, wherein the information for the transaction identifies an attribute associated with the transaction and includes a value for the attribute, wherein the attribute is one of a plurality of attributes associated with the transaction;
• generate a first token using a token generation technique;
• generate a first one-time password (OTP) using the first token and the value received in the information for the transaction;
• transmit a request for a second OTP to the client device, the request for the second OTP identifying the attribute to the client device;
• receive the second OTP from the client device, wherein the second OTP is generated by the client device using a second token and a value provided by the user to the client device for the transaction, and wherein the second token is generated by the client device using the token generation technique;
• determine that the first OTP matches the second OTP, wherein the matching of the first OTP and the second OTP indicates that the value received in the information for the transaction matches the value provided by the user to the client device;
• and
• based on the determining that the first OTP matches the second OTP, transmit, to the application, an indication that the user is successfully authenticated for the transaction, wherein the performing of the transaction is conditioned upon the application receiving the indication from the access manager server that the user is successfully authenticated for the transaction.

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more hardware processors of an access manager system, cause the one or more hardware processors to:

• receive information for a transaction, the transaction requested by a user of a client device and to be performed by an application system, wherein the information for the transaction identifies an attribute associated with the transaction and includes a value for the attribute, and wherein the attribute is one of a plurality of attributes associated with the transaction;
• generate a first token using a token generation technique;
• generate a first one-time password (OTP) using the first token and the value received in the information for the transaction;
• transmit a request for a second OTP to the client device, the request for the second OTP identifying the attribute to the client device;
• receive the second OTP from the client device, wherein the second OTP is generated by the client device using a second token and a value provided by the user to the client device for the transaction, and wherein the second token is generated by the client device using the token generation technique;
• determine that the first OTP matches the second OTP, wherein the matching of the first OTP and the second OTP indicates that the value received in the information for the transaction matches the value provided by the user to the client device;
• and
• based on the determining that the first OTP matches the second OTP, transmit, to the application system, an indication that the user is successfully authenticated for the transaction, wherein the performing of the transaction is conditioned upon the application system receiving the indication that the user is successfully authenticated for the transaction.