Sign in with email only

Identity Engine

Enable an email-only sign-in flow in your app using the embedded SDK.

Learning outcomes

• Configure your Okta org to enable a user to sign in without a password.
• Integrate a password-optional sign-in flow into an app based on an embedded SDK.

What you need

• Download and set up the SDK
  

Sample code

• Sample Java MVC Application using Embedded Authentication with the IDX SDK (opens new window)

---

Update configurations

Before you can start integrating password-optional sign-up flows in your app,

Set up your Okta org for a password-optional use case

. See also

Recommended best practices

.

Note: To test the sign-in integration, you must use a user with an enrolled email authenticator.

Integrate

Summary of steps

The following summarizes the steps involved in the password-optional sign-in flow.

Note: The examples in this guide use Java 11 and Spring Boot MVC.

1: Your app displays the sign-in page

Create a sign-in page that captures the user's username.

Note: The account's username is also its primary email address.

2: The user submits their username

When the user submits their username, create an AuthenticationOptions object and assign its username property to the value entered by the user. Pass this object as a parameter to IdxAuthenticationWrapper.authenticate().

AuthenticationResponse beginResponse = idxAuthenticationWrapper.begin(constructRequestContext());
ProceedContext proceedContext = beginResponse.getProceedContext();
AuthenticationResponse authenticationResponse =
   idxAuthenticationWrapper.authenticate(new AuthenticationOptions(username), proceedContext);

3. The user verifies their identity with the email authenticator

authenticate() returns an AuthenticationResponse object. Query its AuthenticationStatus property to discover the current status of the authentication process. A status of AWAITING_AUTHENTICATOR_VERIFICATION indicates that the user needs to verify their identity with the email authenticator challenge.

switch (response.getAuthenticationStatus()) {
   case AWAITING_AUTHENTICATOR_VERIFICATION:
       return verifyForm(response);

   // other case statements

   default:
       return unsupportedPolicy();
}

The email authenticator supports user verification by one-time passcode (OTP) and by magic links. To learn more, see the Okta email integration guide.

4. Your app handles an authentication success response

After the user verifies their identity using the email authenticator, the status of the authentication process is Success. Call AuthenticationResponse.getTokenResponse() to retrieve the user's OIDC claims information and pass it into your application. The user has now signed in. Store these tokens for future requests and redirect the user to the default page.

Note: In cases where additional sign-in authenticators are required, the user needs to choose and verify all required authenticators before Identity Engine returns an AuthenticationStatus equal to SUCCESS.