1

I am developing an iPhone application to demonstrate the MFA using sms factor with MFA APIs for POC. I am using the authorisation flow for getting my access token (where I get a authorisation code and redeem it for an access token)earlier to MFA implementation. From the documentation, I found out that I need an MFA_token to work with MFA APIs. I added few changes with my existing authorisation process.

I am getting an MFA Token by doing the following steps:

  1. Added scope enroll read:authenticators to authorisation endpoint( i.e. “https://<my_domain>/authorize”)
  2. Added an audience: https://<my_domain>/mfa to the authorisation endpoint
  3. Then I make a post request to token endpoint with authorization code to get the mfa_token.
  4. The only changes I can observe is now the access token(which I presume to be the mfa_token) is in jwt format with expire time 600 sec. By using this access token(=mfa_token)
  5. I built a custom pages for my user for enrollment and challenging the user via sms.
  6. I am able to enroll user, confirm enrollment using this access token.
  7. But when I challenge an user using this access token I get the following error after https://YOUR_DOMAIN/mfa/challenge call.
{
“error”: “invalid_grant”,
“error_description”: “Malformed mfa_token”
}

Can anyone please say me where I am going wrong?

Is the access token same as the MFA_Token in my case?

Thanks in Advance!

1 Answer 1

0

I think the access_token only serves as mfa_token during OOB/device registration. Thenafter, the user will get an mfa_token during auth, which is passed for MFA/OTP challenges

Sign up to request clarification or add additional context in comments.

1 Comment

Thanks for replying and apologies for replying to your comment lately. No, access_token & mfa_token are two different thing here. I tried with the same strategy it didn't worked. We can get the mfa_token by using Resource Owner Password Flow only. I was able to get it in the response. Earlier I was trying with authorisation code flow and was not able to get. Please refer: auth0.com/docs/secure/multi-factor-authentication/…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.