OktaDirectAuth/public
Index
Authentication Factors
Classes
Customization
Enumerations
Essentials
Factor Context
Interfaces
Response Statuses
Status Context
Type Aliases
Authentication Factors
ContinuationFactor
OOBFactor
Authenticate the user out-of-band using Okta Verify.
This is used along with a user identifier to perform a passwordless sign in using Okta Verify. For example:
let status = try await flow.start("jane.doe@example.com", with: .push)
Type declaration
channel: OOBChannel
The channel to use when requesting an out-of-band verification.
readonlytype: PrimaryFactorType.oob
Indicates the type of factor.
For languages supporting associated enum values (such as Swift) this property should be omitted.
OTPFactor
Authenticate the user with the given OTP code.
This usually represents app authenticators such as Google Authenticator, and can be supplied along with a user identifier. For example:
let status = try await flow.start("jane.doe@example.com", with: .otp("123456"))
Type declaration
readonlycode: String
The OTP code from the user's authenticator app / device.
readonlytype: PrimaryFactorType.otp
Indicates the type of factor.
For languages supporting associated enum values (such as Swift) this property should be omitted.
PasswordFactor
Authenticate the user with the given password.
This is used when supplying a password as a primary factor. For example:
let status = try await flow.start("jane.doe@example.com", with: .password("SuperSecret"))
Type declaration
password: String
The user's password, which will be submitted to the server.
readonlytype: PrimaryFactorType.password
Indicates the type of factor.
For languages supporting associated enum values (such as Swift) this property should be omitted.
PrimaryFactor
Defines the list of possible primary authentication factors.
These values are used by the start function.
PromptContinuationFactor
Respond to an OOB authentication where a code is supplied to a second channel, which will be supplied here.
This is used when some code needs to be supplied by the user in response to an out-of-band authentication, for example when authenticating using an SMS phone factor.
var status = try await flow.start("jane.doe@example.com", with: .oob(channel: .sms)
if case let .continuation(type) = status,
case let .prompt(_) = type
{
// Prompt the user to input the code
let verificationCode = await getCodeFromUser()
let newStatus = try await flow.resume(status, with: .prompt(verificationCode))
}
Type declaration
code: String
The code the user received (e.g. via SMS or email) which will be sent to the server to continue an out-of-band factor.
readonlytype: ContinuationFactorType.prompt
Indicates the type of continuation.
For languages supporting associated enum values (such as Swift) this property should be omitted.
SecondaryFactor
Defines the list of possible secondary authentication factors.
These values are used by the resume function.
TransferContinuationFactor
Continues an OOB authentication by transfering the binding to another authenticator, and waiting for its response.
For example, if an Okta Verify number challenge needs to be presented to the user (also referred to as a "Binding Transfer"), the OOB authentication can be continued.
if case let .continuation(type) = status,
case let .transfer(_, code: code) = type
{
// Present the code to the user
status = try await flow.resume(status, with: .transfer)
}
Type declaration
readonlytype: ContinuationFactorType.transfer
Indicates the type of continuation.
For languages supporting associated enum values (such as Swift) this property should be omitted.
WebAuthnContinuationFactor
Respond to a WebAuthn challenge with an authenticator assertion.
This uses a previously supplied WebAuthn challenge (using WebAuthnFactor either as a primary factor or a secondary factor) to respond to the server with the signed attestation from the local authenticator.
Type declaration
readonlyresponse: WebAuthn.AuthenticatorAssertionResponse
readonlytype: ContinuationFactorType.webAuthn
Indicates the type of continuation.
For languages supporting associated enum values (such as Swift) this property should be omitted.
WebAuthnFactor
Authenticate the user using WebAuthn.
This requests that a new WebAuthn challenge is generated and returned to the client, which can subsequently be used to sign the attestation for return back to the server.
let status = try await flow.start("jane.doe@example.com", with: .webAuthn)
Type declaration
readonlytype: PrimaryFactorType.webAuthn
Indicates the type of factor.
For languages supporting associated enum values (such as Swift) this property should be omitted.
Response Statuses
Status
The current status of the authentication flow.
This value is returned from start or resume to indicate the result of an individual authentication step. This can be used to drive your application's sign-in workflow.
For languages that support enums containing associated values (such as Swift), the Status can be implemented as a single enum which contains the relevant associated values.
For all other languages, the common interface that defines a type, and can be used to detect the concrete implementation at runtime, should be used.
Depending on the type, one of the following concrete responses will be returned:
| Status Type | Description |
|---|---|
| SuccessStatus | Authentication succeeded, with the supplied token |
| ContinuationStatus | The current factor needs a response from the user or developer |
| MFARequiredStatus | Additional factors are required to sign in |
Status Context
Continuation
Defines the abstract interface that defines multiple continuation types.
For languages that support enums containing associated values (such as Swift), the Continuation Type can be implemented as a single enum which contains the relevant associated values.
For all other languages, the common interface that defines a type, and can be used to detect the concrete implementation at runtime, should be used.
| Continuation Type | Description |
|---|---|
| WebAuthnContinuation | Contains the server's WebAuthn credential request. |
| TransferContinuation | The authentication channel's binding needs to be transfered. |
| PromptContinuation | The user needs to be prompted for a code. |
MFAContext
Context information used to define a request from the server to perform a multifactor authentication.
This is largely used internally to ensure the secondary factor is linked to the user's current authentication session, but can be used to see the list of challenge types that are supported.
This object serves two purposes to the SDK:
- Inform the developer which challenge grant types are supported for use as an MFA factor.
- Encapsulates the
mfaTokenvalue supplied by the server as a private/internal property.
The mfaToken is not directly useful by the developer, but is required when responding with an MFA factor, so it should be stored contextually with the status.
Type declaration
readonlymfaToken: String
Stores the token supplied by the server response which is used in subsequent requests to resume the MFA authentication.
Internal: This property is not actionable by the developer, and should be protected/internal.
optionalreadonlysupportedChallengeTypes?: [GrantType]
The list of possible grant types that the user can be challenged with.
WebAuthnContext
Holds information about a challenge request when initiating a WebAuthn authentication.
Type declaration
optionalreadonlymfaContext?: MFAContext
The optional MFA context information used when this WebAuthn request is used to resume authentication.
Internal: This property is not actionable by the developer, and should be protected/internal.
readonlyrequest: WebAuthn.CredentialRequestOptions
The credential request returned from the server.
Type Aliases
BindingContext
Holds information about the binding update received when verifying OOB factors.
At this time, the contents of this object have no developer-actionable properties that are required to be exposed.
Therefore, all members of this object are private/internal, but still needs to be persisted, and supplied by the developer on subsequent resume function calls, to ensure the proper handoff of the appropriate request parameters.
Type declaration
optionalreadonlymfaContext?: MFAContext
(Optional) MFA context information used when the binding context object is used on conjunction with a secondary factor.
Internal: This property is not actionable by the developer, and should be protected/internal.
readonlyoobResponse: OOBResponse
Contains the server response describing the paricular characteristics of this out-of-band (OOB) authenticator verification.
Internal: This property is not actionable by the developer, and should be protected/internal.
OOBResponse
Contains the details about the code, expiration, channel, and other values necessary for the client to respond to an OOB request.
At this time, the contents of this object have no developer-actionable properties that are required to be exposed.
Therefore, all members of this object are private/internal, but still needs to be persisted, and supplied by the developer on subsequent resume function calls, to ensure the proper handoff of the appropriate request parameters.
Type declaration
optionalreadonlybindingCode?: String
The binding code, if any, to supply to the user. This is used with the TransferContinuationFactor.
readonlybindingMethod: BindingMethod
The binding method for the OOB authentication.
readonlychannel: OOBChannel
The OOB channel being used.
readonlyexpiresIn: TimeInterval
The time interval until this particular OOB response expires.
optionalreadonlyinterval?: TimeInterval
If the authentication factor requires the client to poll, this indicates the polling interval with which to contact the server.
readonlyoobCode: String
The internal code used to inform the server which out-of-band request is being responded to.
Enumeration defining the list of possible authenticator "Continuation" factors, which are used.
Some authenticators cannot complete authentication in a single step, and requires either user intervention or an additional challenge response from the client. These circumstances are represented by the continuation status. In this case, the appropriate Continuation Factor response type can be supplied to the resume function.