Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

OKTA Developer Exam > Authentication Transaction Model > Flashcards

Authentication Transaction Model Flashcards

1
Q

What does the Authentication API do?

A

Provide operations to authenticate users, perform MFA enrollment and verification, recover forgotten passwords and unlock accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two ways that the OKTA Authentication API can be used?

A

As a standalone API to provide the identity layer on top of your existing application or integrated with the OKTA Sessions API to obtain an Okta sessions cookie and access apps with OKTA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the Okta sessions API?

A

Provides operations to create and manage authentication sessions for users in your Okta organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who is the Authentication API targeting?

A

Developers who want to build their own end-to-end login experience to replace the built in Okta login experience.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What scenarios does the Authentication API address?

A

Primary authentication which lets you verify username and password credentials for a user.

MFA authentication which strengthens the security of password-based authentication by requiring additional verification of another factor.

Recovery, which lets users reset their password if they’ve forgotten it or unlock their account if it has been locked out because of too many login attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How can the behavior of the Okta Authentication API vary?

A

It can vary depending on the type of your application

Your org’s security policies such as the global session policy, the MFA enrollment policy, or the Password policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How are policies evaluated by Okta for authentication?

A

Based on the client request context, such as IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the new name for the MFA Enrollment Policy name in Identity Engine?

A

Authenticator Enrollment Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a public application?

A

An application that anonymously starts a authentication or recovery transaction without an API toke, such as the OKTA sign widget.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are some characteristics of public applications?

A

Aggressively rate limited to prevent abuse

Require primary authentication to be successfully completed before releasing any metadata about a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are trusted applications?

A

Backend applications that act as authentication broker or login portal for your Okta organization and may start an authentication or recovery transaction with an administrator token.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are some characteristics of trusted applications?

A

They may implement their own recovery flows and primary authentication process

They may receive additional metadata about the user before primary authentication has successfully completed

May need to override the client request context to forward the originating client context for the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How does every authentication transaction start?

A

With primary authentication which validates a user’s primary password credential. Password Policy, MFA Policy, and Sign On Policy are evaluated during primary authentication to determine if the user’s password is expired, a Factor should be enrolled, or additional verification is required.

The transaction state of the response depends on the user’s status, group memberships and assigned policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the request parameters for primary authentication?

A

audience: (deprecated) App ID of the target app the user is signing into

context: Provides context for the authentication transaction

options: Opt-in features for the authentication transaction

password: User’s password credential

token: Token received as part of the activation user request

username: User’s non qualified short-name (e.g. chad.sterling) or unique fully qualified sign-in name (e.g. chad.sterling@okta.com)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What opt-in features for the authentication transaction state machine?

A

multiOptionalFactorEnroll: Transitions transactions back to MFA_ENROLL state after successful Factor enrollment when additional optional factors are available for enrollment.

warnBeforePasswordExpired: Transitions transactions to PASSWORD_WARN state before SUCCESS if the user’s password is about to expire and within their password policy warn period

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a context object?

A

Allows trusted web applications such as an external portal to pass additional context for the authentication or recovery transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do you override context?

A

Overriding context such as deviceToken is a highly privileged operation limited to trusted web applications and requires making authentication or recovery requests with a valid administrator API token. If an API token is not provided, the deviceToken will be ignored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a deviceToken?

A

A globally unique ID identifying the user’s client device or user agent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How is the deviceToken used?

A

You must pass the same deviceToken for a user’s device with every authentication request or per device or per session Sign-On Policy Factor challenges. If the deviceToken is absent or does not match the previous deviceToken, the user is challenged every-time instead of per-device or per-session.

You must always pass the same deviceToken for a user’s device with every authentication request for new device security behavior detection. If the deviceToken is absent or doesn’t match a recent deviceToken for the user, the request is considered to be from a new device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are some best practices for generating and storing deviceTokens for web applications?

A

For web apps, Okta recommends that you generate a UUID or GUID for each client and persist the deviceToken using a secure, HTTP-only cookie or HTML5 localStorage scoped to the customer’s domain as the default implementation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are some best practices for generating and storing deviceTokens for native apps?

A

For native apps, ask the device operating system for a unique device ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the transaction object?

A

The Authentication API is a stateful API that implements a finite state machine with defined states and transitions. Each initial authentication or recovery request is issued a unique state token that must be passed with each subsequent request until the transaction is complete or cancelled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does the 401 unauthorized state mean for the authentication transaction object?

A

401 unauthorized status code is returned for requests with invalid credentials, locked out accounts or access denied by sign-on policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the 429 too many requests state mean for the authentication transaction object?

A

This is returned when the rate-limit is exceeded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is primary authentication with public application?

A

Authenticating a user with username/password credentials via a public application?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What happens if we the user’s password policy is configured to show lockout failures?

A

If the user’s password policy is configured to show lockout failures, the authentication process completes with LOCKED_OUT status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is primary authentication with trusted application?

A

Authenticates a user through a trusted application or proxy that overrides the client request context.

The public IP address of your trusted application must be allowed as a gateway IP address to forward the user agent’s original IP address with the X-Forwarded-For HTTP header

The Authorization: SSWS ${api_token} header is optional, in case of a SPA (Single Page app) this header can be omitted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is primary authentication with activation token?

A

Authenticates a user through a trusted application or proxy that overrides a client request context.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What happens when authenticating with activation tokens if the user was created without credentials?

A

If the user was created without credentials, the response will trigger the workflow to set the user’s password. After the password is configured, depending on the MFA setting, the workflow continues with MFA enrollment or successful authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How do you set up primary authentication with device fingerprinting

A

Include the X-Device-Fingerprint header. This header can be used in the following ways:

If the new or unknown device email notification is enabled, an email is sent to the user if the device fingerprint sent in the X-Device_fingerprint header isn’t associated with a previously successful user sign in.

If you have the security behavior detection feature enabled and you have a new device behavior configured in a policy rule, a new device is detected if he device fingerprint sent in the X-Device_Fingerprint header isn’t associated with a previously successful user sign.

This feature has been deprecated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How do you specify your device fingerprint in the X-Device-Fingerprint header?

A

It is highly privileged operation that is limited to trusted web applications and requires making authentication requests with a valid API token. Only send the device fingerprint if the trusted app has a computed fingerprint for the end user’s client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How is the X-Device-Fingerprint header different from the device token?

A

Device-based MFA in the Okta Sign-on policy rules depends on the device token only and not on the X-Device-Fingerprint header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are best practices for Device fingerprint with web apps?

A

Okta recommends using a secure HTTP-only cookie with a random/unique value on the customer’s domain s the default implementation.

34
Q

What are best practices for Device fingerprint with native apps?

A

Ask the device operating system for a unique device ID

35
Q

How do you warn a user that their password is about to expire?

A

set the warnBeforePasswordExpired option to true.

Non-expired passwords successfully complete the authentication transaction if this option is omitted or set to false.

36
Q

What is the password expiration warning?

A

Notifies the user that their password is about to expire and gives them the option to change it.

37
Q

What is SP-initiated step up authentication?

A

*Early access feature

Only supported for SAML-based apps

You must enable the custom sign in page before using (only available with Okta Classic)

Every step up transaction starts with the user accessing an application. If step-up authentication is required, Okta redirects the user to the custom sign-in page with state token as a request parameter.

38
Q

How does step-up authentication work without Okta session?

A

Primary authentication has to be completed by using the value of stateToken request parameter passed to custom sign-in page.

Global session policy and the related authentication policy are evaluated after successful primary authentication.

39
Q

How does Factor enrollment work for step up authentication with Okta session?

A

The user is assigned to an MFA Policy that requires enrollment during the sign-in process and must select a Factor to enroll to complete the authentication process.

40
Q

What is IDP initiated step up authentication

A

*Early access feature

Only supports WS-Federation and SAML based apps

Passes the application instance ID of the app as “audience” along with the user credentials. (Audience is a deprecated _parameter. )

41
Q

What is the Authorization API endpoint to change a password?

A

/api/v1/authn/credentials/change_password

42
Q

What information do you need to provide to the change_password enpoint?

A

Either the existing password and the new password for authentication transactions with either the PASSWORD_EXPIRED or PASSWORD_WARN state.

43
Q

What is the purpose of the PASSWORD_EXPIRED status?

A

A user must change their expired password for an authentication transaction with this status to successfully complete the transaction

44
Q

What is the purpose of the PASSWORD_WARN status?

A

A user may opt-out of changing their password when the transaction has this status

45
Q

What are the request parameters for change password?

A

newPassword: New password for user

oldPassword: User’s current password that is expired or about to expire

revokeSessions: When set to true, revokes all user sessions except for the current session

stateToken: state token for the current transaction

46
Q

What is the Authorization API endpoint to enroll, activate, manage, and verify factors?

A

/api/v1/authn/factors

47
Q

What is the enpoint outside the authorization context to manage factors?

A

/api/v1/users/:uid/factors/

48
Q

What are the request parameters for enroll Factor?

A

factorType type of Factor

profile profile of a supported factor

provider Factor provider

stateToken state token for the current transaction

49
Q

What state does the authentication transaction transition to if a Factor requires activation?

A

MFA_ENROLL_ACTIVATE

50
Q

What does the Enroll Okta Security Question Factor do?

A

Enrolls a user with the Okta question factor and question profile.

The Security Question Factor doesn’t require activation and is ACTIVE after enrollment

51
Q

What does the Enroll Okta SMS Factor do?

A

Enrolls a user with the Okta sms Factor and an SMS profile. A text message with an OTP is sent to the device during enrollment and must be activated by following the next link relation to complete the enrollment process.

52
Q

What does the Enroll Okta Call Factor do?

A

Enrolls a user with the Okta call factor and a Call profile. A voice call with an OTP is sent to the device during enrollment and must be activated by following the next link relation to complete the enrollment process.

53
Q

What does the Enroll Okta Email Factor do?

A

Enrolls a user with the Okta email Factor using the user’s primary email address. An email message with an OTP is sent to the user during enrollment and must be activated by following the next link relation to complete the enrollment process.

54
Q

What does the Enroll Okta Verify TOTP Factor do?

A

Enrolls a user with the Okta token:software:totp Factor. The Factor must be activated after enrollment by following the next link relation to complete the enrollment process.

This implements the TOTP standard, which is used by apps like Okta Verify and Google Authenticator.

55
Q

What does the Email Okta Verify Push Factor do?

A

Enrolls a user with the Okta verify push Factor. The Factor must be activated on the device by scanning the QR code or visiting the activation link sent via email or sms.

Use the published links to embed the QR code or distribute an activation ‘email’ or ‘sms’

This also implements the TOTP standard

56
Q

What does the authentication poll request do?

A

Verifies successful authentication and obtains a session token

57
Q

Who can use the WebAuthN Factor?

A

Those using the Style the Okta hosted Sig In Widget. If you are using a self-hosted customized sign-in widget, you must first upgrade to widget version 3.4.0 and enable the configuration option.

58
Q

What is the request parameter for Enroll WebAuthn?

A

stateToken: stateToken for the current transaction

59
Q

What are the response parameters for Enroll WebAuthn?

A

In the embedded resources object, the factor._embedded.activation object contains properties used to guide the client in creating a new WebAuthn credential for use with Okta.

60
Q

What enrollment factor is not supported via the Authentication API?

A

Enroll custom HOTP Factor

61
Q

What is the API endpoint for the Activate Factor?

A

/api/v1/authn/factors/${factorId}/lifecycle/activate

62
Q

What are the request parameters for activate TOTP Factor?

A

factorId: id of Factor returned from enrollment

passCode: OTP generated by device

stateToken: state token for the current transaction

63
Q

What are the request parameters for Activate SMS Factor?

A

factorId: id of Factor returned from enrollment

passCode: OTP generated by device

stateToken: state token for the current transaction

64
Q

What are some characteristics of the Activate Push Factor?

A

Asynchronous

Myst be polled for completion when the factorResult returns a WAITING status

Have a short lifetime and TIMEOUT if they are not completed before the expireAt timestamp

65
Q

What are the request parameters for Activate Push Factor?

A

factorId: id of Factor returned from enrollment

stateToken: state token for the current transaction

66
Q

What are the request parameters for Activate u2f Factor?

A

clientData: base64-encoded client data from U2F javascript call

factorId: id of Factor returned from enrollment

registrationData: base64-encoded registration data from U2F javascript call

stateToken: state token for the current transaction

67
Q

What are the request parameters for Activate WebAuthn request parameters?

A

attestatiom: base64-encoded attestation from the WebAuthn javascript call

clientData: base64-encoded client data from WebAuthn javascript call

factorId: id of Factor returned from enrollment

stateToken: state token for the current transaction

68
Q

What is the Verify Factor?

A

Verifies an enrolled Factor for an authentication transaction with the MFA_REQUIRED or MFA_CHALLENGE state.

69
Q

What is the endpoint for the Verify Security Question Factor?

A

/api/v1/authn/factors/$[factorId}/verify

70
Q

What are the request parameters for verify Security Question Factor?

A

answer: answer to security question

factorId: id of factor

rememberDevice: user’s decision to remember the device

stateToken: state token for the current transaction

71
Q

What are the request parameters for verify SMS Factor?

A

factorId: id of factor

passCode: OTP sent to device

rememberDevice: user’s decision to remember the device

stateToken: state token for the current transaction

72
Q

What are the request parameters for verify Call Factor?

A

factorId: id of factor

passCode: OTP sent to device

rememberDevice: user’s decision to remember the device

stateToken: state token for the current transaction

73
Q

What are the request parameters for verify TOTP Factor?

A

factorId: id of factor

passCode: OTP sent to device

rememberDevice: user’s decision to remember the device

stateToken: state token for the current transaction

74
Q

What are the request parameters for verify Push Factor?

A

autoPush: user’s decision to send a push to the device automatically

factorId: id of factor

rememberDevice: user’s decision to remember the device

stateToken: state token for the current transaction

75
Q

What are the request parameters for verify U2F Factor?

A

clientData: Base64 encoded client data from the U2F token

factorId id of Factor

rememberDevice user’s decision to remember the device

signatureData base64-encoded signature data from the U2F token

stateToken state token for the current transaction

76
Q

What is the endpoint for verify WebAuthn Factor?

A

/api/v1/authn/factors/${factorIdOrFactorType}/verify

77
Q

What are the request paramaters for verify WebAuthn Factor?

A

authenticatorData base64-encoded authenticator data from the WebAuthn authenticator

clientData base64-encoded client data from the WebAuthn authenticator

factorId id of factor

factorType factorType of Factor; for WebAuthn, it is webauthn

rememberDevice user’s decision to remember the device

signatureData base64-encoded signature data from the WebAuthn authenticator

stateToken state token for the current transaction

78
Q

What are the request parameters for forgot password?

A

factorType Recovery Factor to use for primary authentication

username User’s non-qualified short-name (for example: dad.murphy) or unique fully qualified sign-in name (dade.murphy@example.com)

79
Q

How does forgot password with trusted application work?

A

Allows a trusted application such as an external portal to implement its own primary authentication process and directly obtain a recovery token for a user given just the user’s identifier.

80
Q

What are the request parameters for verify SMS recovery Factor?

A

passCode OTP sent to device

stateToken state token for the current recovery transaction

OKTA Developer Exam (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions