I have MFA factor enrollment set org-wide to enroll users in MFA only when they are first challenged. Then I have an OIDC app using the Authorization Code flow which has a sign on policy that prompts for MFA once per session. So upon logging in to the OIDC app (making the call to /authorize), an MFA…

Hi @cat When accessing the authorization endpoint and having the app level MFA prompt, there is a stateToken generated which is used to prompt for MFA. If you are using a custom domain , you can update the login page for the custom domain URL and capture the stateToken as follows: var config = Okt…

No, but then the Okta-hosted signin widget would be shown instead of my self-hosted widget.

Hi @cat The self hosted Okta sign-in widget does not support the application level MFA. The solution would be to either redirect the users to the Okta /authorize endpoint or use organization level MFA under Admin >> Security >> Authentication >> Sign On (if you are using the developer console admin…

Ok bummer! Do you know if support for app-level MFA is on the roadmap for the signin widget?

This feature is also known as ‘step-up’ authentication for OAuth/OIDC. Requests for this capability have been made since at least 2017. This capability exists for applications using SAML (which confuses people – why does it exist for SAML, but not for OAuth??). Over a year ago, I did an analysis …

Thanks for the info! I agree, this is really frustrating. Why is application level MFA even a feature if you can’t use it for OIDC apps??

@dragos It seems like the Okta-hosted signin widget supports App level MFA. Is it using some proprietary Okta APIs to do this? Or can you share the implementation logic so I can replicate it? I’m very comfortable modifying the widget source code itself - we’ve already done this extensively to add ot…

Hi @dragos , Thank you for the suggestion. I implemented this and got it to work! The Okta-hosted widget is redirecting to my self-hosted widget, and I’m able to retrieve the stateToken to get the MFA prompt. Just so others know, after MFA is successful, I’m getting a callback in function success(r…

The client specified not to prompt, but the client app requires re-authentication or MFA

Questions OAuth/OIDC

gpadma October 7, 2020, 12:09am 2

Hi @cat,
Does this error occur even if there is no prompt parameter in /authorize request ?

Post		Replies	Views
Okta React Signin widget - not working for App level MFA OAuth/OIDC	0	2551	July 16, 2022
App Level MFA support Okta - React (Auth JS, Signin Widget) OAuth/OIDC	0	2249	December 20, 2022
Okta React Sign-In Widget with MFA Questions	7	6663	October 17, 2019
Javascript Okta Sign-In Widget - MFA not properly working Questions	5	5006	November 2, 2021
Using Application Sign-on Policy with MFA via API Questions	4	4924	October 8, 2020

The client specified not to prompt, but the client app requires re-authentication or MFA

Related topics