Okta Account Unlock for Embedded Logins Returns Different Recovery Authenticators Than Okta Hosted

When administrators set the Password Recovery Authenticators Access Control to Authentication policy, embedded widget logins return legacy rule authenticators instead of the options defined in the Okta Account Management policy. This behavior occurs by design due to internal implementation details, requiring administrators to use alternative methods like the Okta Management Unlock User API or confidential IDX SDKs. Okta-hosted account unlocks return only the enrolled authenticators allowed in the Okta Account Management policy, while the embedded widget or okta-auth-js account unlock recovery flows continue to use legacy rule authenticators.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Account Unlock
• Embedded Widget
• okta-auth-js

This behavior occurs by design due to Okta internal implementation details.

How are account unlock recovery flows resolved for embedded widgets?

Currently, an embedded widget or okta-auth-js account unlock recovery flow cannot use the recovery authenticators defined in the Okta Account Management policy. Administrators manage account unlock recovery flows by restricting the flows to the Okta-hosted login page, implementing the Okta Management Unlock User API, or utilizing an Okta confidential IDX SDK.

• Update the Unlock Help Link to point to a backend service that could handle the unlock with the Okta Management Unlock User API.
• Utilize an Okta confidential IDX SDK for account unlock recovery flows, such as okta-idx-dotnet, okta-idx-java, okta-mobile-kotlin, or okta-mobile-swift.