br0lq (br0lq) asked a question.
I'm connecting my own server application using LDAP protocol over LDAPS to verify user authentication against OKTA.
Currently its one step only, ie username and password/OTP, which works fine, using Bind
However, I've been asked to also support OKTA 2FA for a new onboarding customer
The customer has users with both OTP and 2FA.
The OTP users are not a problem at all, but the 2FA are as my application doesn't support OKTA 2FA yet.
My questions are:
1) How can I check if single factor password/OTP applies for a given account, or if 2FA applies for the given account?
2) How can I verify the 2FA when LDAP protocol is used? Or should I use another protocol like API?
Any reference to relevant documentation is highly appreciated.
That all depends on your Sign-on Policy really. You can have a Sign-on Policy which applies specifically when a user authenticates the LDAP Interface. You should have MFA as mandatory on the Sign-on Policy too.
Then there is 2 ways a user can interact with LDAP for MFA.
https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-main.htm
The Read Only Admin account you should be using to connect your application to Okta LDAP Interface won't be able to authenticate with MFA, so you should have a Sign-on Policy only allow that account from your apps IP (in a Okta Network Zone) to authenticate with the LDAP Interface > then do a Catch All Deny rule afterwards on anything else.