Transition Between Account Unlock and Password Reset Without a Second Verification Using Okta-Auth-JS
Last Updated:
Overview
Unlocking an account with the Okta Sign-In Widget allows an immediate password reset without requiring another challenge. The same unlock flow using okta-auth-js does not provide a password recovery remediation step after an account unlock. Developers can achieve a seamless password recovery without an extra challenge step by using the currentAuthenticatorEnrollment-recover function.
Applies To
- Okta Identity Engine (OIE)
- Embedded okta-auth-js
- Password Recovery
Solution
How does an administrator perform a seamless password recovery without an extra challenge?
When completing the account unlock phase using okta-auth-js, the next available remediation step options are typically challenge-authenticator or select-authenticator-authenticate. Okta does not provide a remediation step for Account Recovery, which may require starting a new Identity Engine (IDX) Password Recovery flow. Starting a new flow requires another challenge.
To avoid this extra challenge after an account unlock, use the currentAuthenticatorEnrollment-recover function returned in the available Actions from the Unlock Account response.
Execute the account unlock and complete a password recovery immediately afterward without another challenge by implementing the following code sequence.
_ = await authClient.idx.start();
_ = await authClient.idx.proceed({step: 'unlock-account'});
_ = await authClient.idx.proceed({step: 'select-authenticator-unlock-account', identifier: '{user}@{mail}', authenticator: { id: '{Authenticator_ID}', methodType: 'email' } });
var unlockResponse = await authClient.idx.proceed({step: 'challenge-authenticator', credentials: { passcode: '{Email_OTP}' } });
var recoverResponse = await unlockResponse.actions['currentAuthenticatorEnrollment-recover']()
authClient.transactionManager.saveIdxResponse(recoverResponse);
_ = await authClient.idx.proceed({step: 'reset-authenticator', credentials: { passcode: '{New_Password}', revokeSessions: true } });
...
complete remaining login steps or get tokens if no further authentication is required
Key calls used in the code sequence to transition into Recovery immediately after Unlock.
unlockResponse.actions['currentAuthenticatorEnrollment-recover']()- This uses the response from the prior unlock challenge call to invoke an action to recover the current authenticator (Password).authClient.transactionManager.saveIdxResponse(recoverResponse)- This sets the internal state of okta-auth-js to align with the response from thecurrentAuthenticatorEnrollment-recoverfunction call.
NOTE: The provided example is simplistic for demonstration purposes. All custom Identity Engine (IDX) integrations must check for errors from the prior IDX response and verify the next available remediation steps.
