Sign in with email only

Identity Engine

Enable an email-only sign-in flow in your app using the embedded SDK.

Learning outcomes

• Configure your Okta org to enable a user to sign in without a password.
• Integrate a password-optional sign-in flow into an app based on an embedded SDK.

What you need

• Download and set up the SDK
  

Sample code

• Sample ASP.NET MVC Application using Embedded Authentication with the IDX SDK (opens new window)

---

Update configurations

Before you can start integrating password-optional sign-up flows in your app,

Set up your Okta org for a password-optional use case

. See also

Recommended best practices

.

Note: To test the sign-in integration, you must use a user with an enrolled email authenticator.

Integrate

Summary of steps

The following summarizes the steps involved in the password-optional sign-in flow.

1: Your app displays the sign-in page

Create a sign-in page that captures the user's username.

Note: The account's username is also its primary email address.

2: The user submits their username

When the user submits their username, create an AuthenticationOptions object and assign its Username property to the value entered by the user. Pass this object as a parameter to IdxClient.AuthenticateAsync().

var authnOptions = new AuthenticationOptions { Username = model.UserName };
var authnResponse = await _idxClient
   .AuthenticateAsync(authnOptions).ConfigureAwait(false);

3. The user verifies their identity with the email authenticator

AuthenticateAsync() returns an AuthenticationResponse object. Query its AuthenticationStatus property to discover the current status of the authentication process. A status of AwaitingChallengeAuthenticatorSelection indicates that the user needs to verify their identity with the email authenticator challenge.

switch (authnResponse?.AuthenticationStatus)
{
   case AuthenticationStatus.AwaitingChallengeAuthenticatorSelection:
      Session["authenticators"] = ViewModelHelper.
         ConvertToAuthenticatorViewModelList(authnResponse.Authenticators);
      Session["isChallengeFlow"] = true;
      return RedirectToAction("SelectAuthenticator", "Manage");

   // other case statements

   default:
      return View("Login", model);
}

The email authenticator supports user verification by one-time passcode (OTP) and by magic links. To learn more, see the Okta email integration guide.

4. Your app handles an authentication success response

After the user verifies their identity using the email authenticator, the status of the authentication process is Success. Call AuthenticationHelper.GetIdentityFromTokenResponseAsync() to retrieve the user's OIDC claims information and pass it into your application. The user has now signed in.

var authnResponse = await _idxClient.VerifyAuthenticatorAsync(
   verifyAuthenticatorOptions, (IIdxContext)Session["idxContext"]);
Session["idxContext"] = authnResponse.IdxContext;

switch (authnResponse.AuthenticationStatus)
{

   case AuthenticationStatus.Success:
      ClaimsIdentity identity = await AuthenticationHelper
         .GetIdentityFromTokenResponseAsync(
            _idxClient.Configuration, authnResponse.TokenInfo);
      _authenticationManager.SignIn(new AuthenticationProperties(), identity);
      return RedirectToAction("Index", "Home");

   // other case statements
}

return View(view, model);

Store these tokens for future requests and redirect the user to the default page after a successful sign-in attempt.

Note: In cases where additional sign-in authenticators are required, the user needs to choose and verify all required authenticators before Identity Engine returns an AuthenticationStatus equal to SUCCESS.