br0lq (br0lq) asked a question.
OKTA LDAP and 2FA verification?
I'm connecting my own server application using LDAP protocol over LDAPS to verify user authentication against OKTA.
Currently its one step only, ie username and password/OTP, which works fine, using Bind
However, I've been asked to also support OKTA 2FA for a new onboarding customer
The customer has users with both OTP and 2FA.
The OTP users are not a problem at all, but the 2FA are as my application doesn't support OKTA 2FA yet.
My questions are:
1) How can I check if single factor password/OTP applies for a given account, or if 2FA applies for the given account?
2) How can I verify the 2FA when LDAP protocol is used? Or should I use another protocol like API?
Any reference to relevant documentation is highly appreciated.
That all depends on your Sign-on Policy really. You can have a Sign-on Policy which applies specifically when a user authenticates the LDAP Interface. You should have MFA as mandatory on the Sign-on Policy too.
Then there is 2 ways a user can interact with LDAP for MFA.
https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-main.htm
The Read Only Admin account you should be using to connect your application to Okta LDAP Interface won't be able to authenticate with MFA, so you should have a Sign-on Policy only allow that account from your apps IP (in a Okta Network Zone) to authenticate with the LDAP Interface > then do a Catch All Deny rule afterwards on anything else.