# Enroll Duo MFA after logging in to Okta via OIDC

**URL:** <https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209>\
**Category:** OAuth/OIDC\
**Created:** [February 23, 2020, 8:31am UTC](https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209 "2020-02-23T08:31:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![odpeer](https://avatars.discourse-cdn.com/v4/letter/o/aeb1de/32.png) [@odpeer](https://devforum.okta.com/u/odpeer)\
**Post date:** [February 23, 2020, 8:31am UTC](https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209/1 "2020-02-23T08:31:52Z")

</div>

My users are logging in to Okta using OIDC, to get an `id_token`.  
After the user has logged in I want to trigger Duo MFA enrollment, which requires a `stateToken`.

IIUC the only way I can get the `stateToken` is to collect the user credentials and call `POST /api/v1/authn` with the credentials.  
This leads to awkward UX since the user is already logged in, so there shouldn’t be another request to collect credentials.

What would be the best way to trigger Duo MFA enrollment after logging in using OIDC?

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [February 24, 2020, 4:10am UTC](https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209/2 "2020-02-24T04:10:00Z")

</div>

Hi @odpeer

If you are referring to enrolling the user after getting the JWT, you can try [https://developer.okta.com/docs/reference/api/factors/#enroll-factor](https://developer.okta.com/docs/reference/api/factors/#enroll-factor).

---

<div class="post-metadata">

**Author:** ![odpeer](https://avatars.discourse-cdn.com/v4/letter/o/aeb1de/32.png) [@odpeer](https://devforum.okta.com/u/odpeer)\
**Post date:** [February 24, 2020, 6:23am UTC](https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209/3 "2020-02-24T06:23:08Z")

</div>

@dragos I probably didn’t give enough details.

When the user gets to my app I use OIDC to log the user in and get an `id_token` using the `${oktaBaseUrl}/oauth2/default/v1/authorize?client_id=${OKTA_CLIENT_ID}&sessionToken=${sessionToken}&nonce=${nonce}&response_type=id_token&scope=openid%20profile&state=${state}&redirect_uri=${uri}` endpoint  
This lets the user log in Okta screens and I get the id\_token in the `Location` header in the response to that request.  
I use the id\_token to authorize subsequent events using Okta OIDC.

At this point all I have is an id\_token, and a logged in user.  
Now, I want to trigger Duo enrollment in my app.  
I want to use the Enroll Duo Factor API - [https://developer.okta.com/docs/reference/api/authn/#enroll-duo-factor](https://developer.okta.com/docs/reference/api/authn/#enroll-duo-factor), however, this API requires a `stateToken`. To get a state token I need to get the user credentials and call `/api/v1/authn` primary authenication.

I looked in the link you sent. It does not have an example of enrolling Duo as a factor.  
When I tried to send a request `POST {{url}}/api/v1/users/{{userId}}/factors` with

```auto
{
  "factorType": "web",
  "provider": "DUO"
}

```

as described in [https://developer.okta.com/docs/reference/api/factors/#supported-factors-for-providers](https://developer.okta.com/docs/reference/api/factors/#supported-factors-for-providers) I got the following error response

```auto
{
    "errorCode": "E0000060",
    "errorSummary": "Unsupported operation.",
    "errorLink": "E0000060",
    "errorId": "oae-cpHr3dWT3qPkiF7LqmHuQ",
    "errorCauses": []
}

```

Am I missing something in the link you sent?

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [February 26, 2020, 5:36am UTC](https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209/4 "2020-02-26T05:36:06Z")

</div>

Hi @odpeer

Can you please open a support case with us through an email to [support@okta.com](mailto:support@okta.com) in order for one of Support Engineers to assist you with the integration?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 24, 2024, 7:41pm UTC](https://devforum.okta.com/t/enroll-duo-mfa-after-logging-in-to-okta-via-oidc/8209/5 "2024-01-24T19:41:19Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.