The client specified not to prompt, but the client app requires re-authentication or MFA

Questions OAuth/OIDC
11

Hi @dragos,

Thank you for the suggestion. I implemented this and got it to work! The Okta-hosted widget is redirecting to my self-hosted widget, and I’m able to retrieve the stateToken to get the MFA prompt.

Just so others know, after MFA is successful, I’m getting a callback in function success(res) like this:

function success(res) {
    // res.status === 'SUCCESS'
    // res.type === 'SESSION_STEP_UP'
    // res.session === undefined
    // res.stepUp === {
    //    finish: function(),
    //    url: 'https://{oktaBaseUrl}/login/step-up/redirect?stateToken={stateToken}'
    // }
}

At this point you can’t do res.session.setCookieAndRedirect() like you might normally. Instead, use res.stepUp.finish(). It looks like this function will do the setCookieAndRedirect() for you, and will bring you back to the redirect_uri on your original /authorize request.