RogerBW, 21 days ago

@mjg59

1. You give them money.
2. You can log into your machines.
3. Maybe other people can't? Still working on this.

kfh, 21 days ago

@mjg59 hah, the Okta API implementation I'm working on right now seems trivial to MFA enrollment

mjg59, 21 days ago

@kfh I've already figured out how Fastpass works, this should be trivial in comparison but

ljrk, 21 days ago

@mjg59 Wait, it works?

mjg59, 21 days ago

@ljrk I mean it's possible to enroll MFA tokens so I guess?

ljrk, 21 days ago

@mjg59 Maybe I've been burnt by Okta too many times in other contexts :'-)

mjg59, 21 days ago

Enrolling MFA tokens in Firefox while staring at the network debug console and cutting and pasting into curl trying to figure out what the fuck magic is actually happening here

mjg59, 21 days ago

Begging IdP vendors to actually make it possible to script doing everything that a user can do because I do not want to rely on an API token for this

plambrechtsen, 21 days ago

@mjg59 proxy the shizzle via postman or jmeter as Okta is a pain in the ass to grab the session token.
The nightmare continues.

mjg59, 21 days ago

@plambrechtsen I've already got the session token but the documented APIs want an API token (no) and the web flow uses undocumented Identity Engine endpoints

plambrechtsen, 21 days ago

@mjg59 had a look through the Okta postman collection?? Looks like that has everything. https://developer.okta.com/docs/reference/rest/

mjg59, 21 days ago

@plambrechtsen Direct experience is that a lot of it doesn't work with normally scoped OIDC tokens, it's more aimed at different flows

plambrechtsen, 21 days ago

@mjg59 it’s been a few years since I have had to play with the Okta API and I have blacked it out for good reason.
But messing around in postman is how I always got it working first.
You can do an OIDC auth flow using postman and opening an external browser and then the back channel token exchange with the code. Assuming you’re doing a authorisation token flow.

mjg59, 21 days ago

@plambrechtsen I literally can't open an external browser because of how Apple handles hardware backed key ownership