When challenged for Multi-factor Authentication (MFA) verification using the Okta Sign-in Widget on a custom domain, users will normally see a Back to sign in link.

This article describes the steps an admin must take to hide the Back to sign in link on a brand with a custom domain.

• Okta Sign-In Widget 
• Customization
• Custom Code

The generation of the Okta Sign-in Widget (SIW) currently in use will determine which of the two main syntaxes to use in the custom code. The provided examples are for the Okta-Hosted Custom Sign-In Widget, but this option can also be used on a Self-Hosted/Embedded Widget following the steps provided for the Okta-Hosted widget, where Third-generation is not enabled.

View the SIW generation

1. Navigate to Admin > Customizations > Brands.
2. Click the appropriate Brand to customize.
3. In the custom Brand, click Pages.
4. Find the section for the Sign-in page and click Configure.
5. On the Sign-in page configuration, click Settings.

If the Third-generation widget is enabled

1. Click Page Design to see the Code Editor.
2. Click Edit for the code editor.
3. Add or replace the following code.

var config = OktaUtil.getSignInWidgetConfig(); 
// Render the Okta Sign-In Widget 
var oktaSignIn = new OktaSignIn(config); 

with

var config = OktaUtil.getSignInWidgetConfig();
// Render the Okta Sign-In Widget
config.features.hideSignOutLinkInMFA = true;
var oktaSignIn = new OktaSignIn(config);

4. Click Save to Draft.
5. Click Publish.

If the Third-generation widget is not enabled

1. Click Page Design to see the Code Editor.
2. Click Edit for the code editor.
3. Add or replace the following code.

var config = OktaUtil.getSignInWidgetConfig();
// Render the Okta Sign-In Widget
var oktaSignIn = new OktaSignIn(config);

with

var config = OktaUtil.getSignInWidgetConfig();
// Render the Okta Sign-In Widget
config[‘features.hideSignOutLinkInMFA’] = true;
var oktaSignIn = new OktaSignIn(config);

4. Click Save to Draft.
5. Click Publish.

After this change, users connecting to the brand's modified Sign-in page will no longer see the Back to sign in button when presented with an MFA challenge.

NOTE:

• Both of the above scenarios were tested using the Sign-In Widget version ^7.
• If Require possession factor before password during MFA is enabled, the MFA possession factor will be triggered first. Depending on what other factors are enrolled/allowed for the user, there may be no link for "verify with something else."
  • This setting can be found under Admin > Security > General > Protect against password-based attacks.

• The previous scenarios remove the "Back to sign in" link from all applications. To remove it when users log into a specific application, use the code from the Per-application customization documentation instead.

Related References

• Style the Sign-in Page
• Okta Identity Engine documentation
• Okta Classic documentation