Sign in with password and email factors

Identity Engine

Note: In proxy model architectures, where a server-side app using the embedded SDK is used as a proxy between client apps and Okta servers, a request context for the client apps is required. Security enforcement is expected to be based on the client request context's IP address and user agent.

However, since these values are currently being derived from the server app rather than the client, this enforcement isn't available. As a result, network zones or behaviors that drive their conditions based on these request context values (geolocation, IP Address, or user agent) won't work until Okta can find a solution to the issue.

Enable a password and email sign-in flow in your app using the embedded SDK.

---

Learning outcomes

• Configure your Okta org to use the email authenticator.
• Challenge a user's identity with password and email factors.

What you need

Identity Engine SDK set up for your own app

Sample code

Golang Identity Engine sample app (archived)

Note: The Okta IDX SDK for Golang (opens new window) has been archived and is no longer actively maintained or supported. This decision was made as part of our efforts to consolidate and improve our SDK offerings. Okta recommends using redirect authentication instead.

The Golang sample apps (opens new window) have also been archived and are no longer actively maintained or supported.

---

Overview

With the embedded SDK, your app can verify a user's identity using a password and then the email authenticator. The email authenticator can complete its verification using

magic links

, a one-time passcode (OTP), or a combination of both.

Update configurations

Before you build a sign-in flow with password and email factors, you must configure the Okta org to accept both factors in your app. To learn how to do this, see the Okta email integration guide.

Integrate

Summary of steps

The following summarizes the steps involved in a sign-in flow using password and email:

1: Your app displays the sign-in page

When the user navigates to the sign-in page and the application loads for the first time, create a new SDK Client object by calling NewClient.

idx, err := idx.NewClient(
      c.Okta.IDX.ClientID,
      c.Okta.IDX.ClientSecret,
      c.Okta.IDX.Issuer,
      c.Okta.IDX.Scopes,
      c.Okta.IDX.RedirectURI)
if err != nil {
    log.Fatalf("new client error: %+v", err)
}

Display a sign-in page that captures the username and password.

During page load, call Client.InitLogin. This returns an object of type LoginResponse that is used to initiate the sign-in process with Okta.

lr, err := s.idxClient.InitLogin(context.TODO())
if err != nil {
   log.Fatalf("Could not initalize login: %s", err.Error())
}

2: The user submits their username and password

When the user submits their username and password, create an IdentifyRequest object and assign its identifier and password properties to the values entered by the user. Pass this object as a parameter to LoginResponse.Identify.

ir := &idx.IdentifyRequest{
   Identifier: r.FormValue("identifier"),
   Credentials: idx.Credentials{
      Password: r.FormValue("password"),
   },
}

lr, err = lr.Identify(context.TODO(), ir)
if err != nil {
   session.Values["Errors"] = err.Error()
   session.Save(r, w)
   http.Redirect(w, r, "/login", http.StatusFound)
   return
}

3: Your app displays a list of authenticators

Identify returns error and LoginResponse objects. The error object contains any errors thrown in the user sign-in. The LoginResponse's Token property contains any ID and access tokens returned by the server if the user has signed in successfully. If the error object is nil and the LoginResponse.Token returns nil, the user needs to confirm their identity with additional factors.

lr, err = lr.Identify(context.TODO(), ir)
if err != nil {
 //Error handling code
}

if lr.Token() != nil {
 //Login completion code
}

Display a list of all of the authenticators that the user has enrolled and are ready for use. For example:

During page load, call LoginResponse object's HasStep method, passing in the LoginStepEmailVerification constant. If the method returns true, display the email factor option.

clr, _ := s.cache.Get("loginResponse")
lr := clr.(*idx.LoginResponse)

if lr.HasStep(idx.LoginStepEmailVerification) {
  s.ViewData["FactorEmail"] = true
} else {
  s.ViewData["FactorEmail"] = false
}

Use the other LoginStep (opens new window)s to populate the rest of the list.

4: The user submits the email authenticator

When the user submits the email authenticator, call LoginResponse.VerifyEmail. Identity Engine sends a verification email to the user if the call is succcessful.

if !ok || !invCode.(bool) {
  lr, err := lr.VerifyEmail(r.Context())
  if err != nil {
    http.Redirect(w, r, "/login", http.StatusFound)
    return
  }
  s.cache.Set("loginResponse", lr, time.Minute*5)
  }
  s.render("loginFactorEmail.gohtml", w, r)

Display a page for the user to submit the verification code from their email.

5: The user submits the email verification code

When the user checks their email for the code and submits it, pass it as a parameter to LoginResponse.ConfirmEmail.

 //Get LoginResponse from session
clr, _ := s.cache.Get("loginResponse")
lr := clr.(*idx.LoginResponse)

session, err := sessionStore.Get(r, "direct-auth")
if err != nil {
  log.Fatalf("could not get store: %s", err)
}

 //Call ConfirmEmail
lr, err = lr.ConfirmEmail(r.Context(), r.FormValue("code"))
if err != nil {
 //Error handling code
}

 //Set returned LoginResponse in session
s.cache.Set("loginResponse", lr, time.Minute*5)
s.ViewData["InvalidEmailCode"] = false

6: Your app handles an authentication success response

If the request to verify the code is successful, LoginResponse.Token now returns the required tokens (access, refresh, ID) for authenticated user activity. Store the tokens in session for later use and then redirect the user to the default signed-in home page.

 //If we have tokens we have success, so lets store tokens
if lr.Token() != nil {
  session, err := sessionStore.Get(r, "direct-auth")
  if err != nil {
    log.Fatalf("could not get store: %s", err)
  }
  session.Values["access_token"] = lr.Token().AccessToken
  session.Values["id_token"] = lr.Token().IDToken

  err = session.Save(r, w)
  if err != nil {
    log.Fatalf("could not save access token: %s", err)
  }
 //Redirect the user to /profile
  http.Redirect(w, r, "/", http.StatusFound)
  return
}

Note: You can request basic user information from Okta's OpenID Connect authorization server after a user has signed in successfully. See Get the user profile information (opens new window).