Basic sign-in flow with the password factor

Identity Engine

Enable a password-only sign-in flow in your web app using the embedded SDK.

Note: Passwords are a security vulnerability because they can be easily stolen and are prone to phishing attacks. Give your users the ability to use other authenticators by replacing password-only sign-in experiences with either a password-optional or a multifactor experience.

---

Learning outcomes

Add a password-only sign-in flow to a server-side web app.

What you need

• An app that uses the embedded Okta Golang Identity Engine SDK (archived)
• Identity Engine SDK set up for your own app

Sample code

Golang Identity Engine sample app (archived)

Note: The Okta IDX SDK for Golang (opens new window) has been archived and is no longer actively maintained or supported. This decision was made as part of our efforts to consolidate and improve our SDK offerings. Okta recommends using redirect authentication instead.

The Golang sample apps (opens new window) have also been archived and are no longer actively maintained or supported.

---

Configuration updates

To configure your app so that it requires only a password, see

Set up your Okta org for a password factor-only use case

.

Summary of steps

The following sequence diagram shows the steps for the basic sign-in flow.

Integration steps

Your app displays the sign-in page

When the user goes to the sign-in page and the app loads for the first time, create an SDK Client object by calling NewClient.

idx, err := idx.NewClient(
      c.Okta.IDX.ClientID,
      c.Okta.IDX.ClientSecret,
      c.Okta.IDX.Issuer,
      c.Okta.IDX.Scopes,
      c.Okta.IDX.RedirectURI)
if err != nil {
    log.Fatalf("new client error: %+v", err)
}

Display a sign-in page that captures the user's name and password.

During page load, call Client.InitLogin. This returns a LoginResponse object that is used to initiate the sign-in process with Okta.

lr, err := s.idxClient.InitLogin(context.TODO())
if err != nil {
    log.Fatalf("Could not initalize login: %s", err.Error())
}

The user submits their username and password

When the user submits their username and password, create an IdentityRequest object and assign its identifier and password properties to the values entered by the user. Pass this object as a parameter to LoginResponse.Identify.

ir := &idx.IdentifyRequest{
    Identifier: r.FormValue("identifier"),
    Credentials: idx.Credentials{
        Password: r.FormValue("password"),
    },
}

lr, err = lr.Identify(context.TODO(), ir)
if err != nil {
    session.Values["Errors"] = err.Error()
    session.Save(r, w)
    http.Redirect(w, r, "/login", http.StatusFound)
    return
}

Your app handles an authentication success response

When the user correctly supplies their password, err is nil and LoginResponse.Token contains the required access and ID tokens to retrieve the user's OIDC claims information. The user is now signed in.

 //If we have tokens we have success, so lets store tokens
if lr.Token() != nil {
  session, err := sessionStore.Get(r, "direct-auth")
  if err != nil {
    log.Fatalf("could not get store: %s", err)
  }
  session.Values["access_token"] = lr.Token().AccessToken
  session.Values["id_token"] = lr.Token().IDToken

  err = session.Save(r, w)
  if err != nil {
    log.Fatalf("could not save access token: %s", err)
  }
 //Redirect the user to /profile
  http.Redirect(w, r, "/", http.StatusFound)
  return
}

Store these tokens for future requests and redirect the user to the default page after a successful sign-in attempt.

Get the user profile information

After the user signs in successfully, request basic user information from the authorization server using the tokens that were returned in the previous step.

func getProfileData(r *http.Request) map[string]string {
  m := make(map[string]string)

  session, err := sessionStore.Get(r, "okta-custom-login-session-store")

  if err != nil || session.Values["access_token"] == nil ||
     session.Values["access_token"] == "" {
    return m
  }

  reqUrl := os.Getenv("ISSUER") + "/v1/userinfo"

  req, _ := http.NewRequest("GET", reqUrl, bytes.NewReader([]byte("")))
  h := req.Header
  h.Add("Authorization", "Bearer "+session.Values["access_token"].(string))
  h.Add("Accept", "application/json")

  client := &http.Client{}
  resp, _ := client.Do(req)
  body, _ := ioutil.ReadAll(resp.Body)
  defer resp.Body.Close()
  json.Unmarshal(body, &m)

  return m
}