"pwd" not found in "amr" for API authn with username and password

Questions API
1

PWD is not found in AMR claim if login in the following method:

  1. {{oktaUrl}}/api/v1/authn - Post with username and password as RAW in JSON to get session token.
  2. {{oktaUrl}}/oauth2/default/v1/authorize - Exchange for Authorization Code with session token and following params
  • client_id
  • response_type = code
  • scope = openid offline_access
  • redirect_uri
  • state = state-XYZ1234
  • code_challenge_method = S256
  • code_challenge
  • sessionToken
  1. {{oktaUrl}}/oauth2/default/v1/token - Exchange for all tokens with Authorization Code
 {
  "sub": "<okta user id>",
  "name": "DEV USER",
  "email": "devuser@XYZ.com",
  "ver": 1,
  "iss": "https://dev-82409540.okta.com/oauth2/default",
  "aud": "<client_id>",
  "iat": 1669360791,
  "exp": 1669364391,
  "jti": "........",
  "amr": [],
  "idp": "<idp id>",
  "sid": "......",
  "preferred_username": "devuser@XYZ.com",
  "auth_time": 1669360778,
  "at_hash": "......",
  "ds_hash": "......."
}

PWD is available in AMR claim if login in the following method:

  1. {{oktaUrl}}/oauth2/default/v1/authorize - paste in browser with all the required params and it will be redirect to Okta Hosted page for username and password.
  • client_id
  • response_type = code
  • scope = openid offline_access
  • redirect_uri
  • state = state-XYZ1234
  • code_challenge_method = S256
  • code_challenge
  1. {{oktaUrl}}/oauth2/default/v1/token - Exchange for all tokens with Authorization Code
{
  <same as above except for amr>
  "amr": [
    "pwd"
  ],
  <same as above except for amr>
}

This is happening when I am using embedded SDK (not widget) to perform login too. Is it due to authentication polices settings?

  • In Authentication Policies → Rules, User must authenticate with Password/IdP option only.
  • In Authenticators → Enrollment, password is set as required and the rest is set as optional (email, okta verify, phone and FIDO2)
2

Hello,

This was most likely caused by a bug for OIE Okta Orgs that was just recently fixed in the *.oktapreview.com environments as of release 2022.11.1

If you have a preview environment can you confirm if you still see this behavior. Production tenants *.okta.com will get the update later this month.

Thank You,

3

Yes. It is showing in oktapreview now.

Thank you.