There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One Time Passcode (OTP) and sends it as an SMS or email to the user.
This OTP expires in 15-30 minutes. Only when the OTP is validated successfully does the user's login complete.
If the user has two devices, and he enters his password in one device, an OTP is generated. But he doesn't use the OTP on the first device. He uses his second device to log in again, and enters his password there. Since it is within 15-30 minutes, the same OTP is generated again. Now he can log in to two devices with the same OTP.
Does this scenario appear to be good?
Continuing the scenario, his id is locked meanwhile for some reason. He attempts to enter the OTP in either of the devices. Now should we allow the login? Otherwise, should we check the id status every time an OTP is validated?
Similarly, in the 15-30 minute interval, if password is changed via the help desk, should we reset the existing sessions that have successful password validation but are waiting for the OTP? Or can we allow the login with the older password itself?
The technical problem here is that password validation is in one system, but the OTP validation is in another system, and they are mutually exclusive. They don't communicate with each other.
Is this OTP validation procedure appropriate?