Sign-in flows
The sequence of a sign-in flow depends on the authentication requirements that you set in your global session policy.
Password-first flow
If the user session is established with a password, the password field appears on the same page as the username field.
The password-first flow is the traditional sign-in flow found in Classic Engine. In Identity Engine, the sequence is the same. Only the Keep me signed in checkbox is different.
- The end user goes to your sign-in page.
- The Sign-In Widget displays Username and Password fields.
- The end user enters a full username, including the domain, and a password.
- Optional. The end user selects Keep me signed in, and then clicks Next.
- If either of your sign-on policies requires a secondary factor, the Sign-In Widget displays the available security methods.
- The end user selects a security method and completes the verification step.
- The end user accesses the application.
If this is the flow that you want for your org, create a global session policy rule that establishes the user session with a password. You can then enforce secondary factors in your global session policy or in an authentication policy.
Identifier-first flow
If the user session is established with any factor used to meet the authentication policy requirements, the username prompt appears first. Identifier-first flows are new to Identity Engine.
- The end user goes to your sign-in page.
- The Sign-In Widget displays a Username field.
- The end user enters a full username, including the domain.
- Optional. The end user selects Keep me signed in, and then clicks Next.
- The Sign-In Widget displays the security methods allowed by your sign-on policies.
- The end user selects a security method and completes the verification step.
- The end user accesses the application.
If you want this flow for your org, create a global session policy rule that establishes the user session with any factor used to meet authentication policy requirements. You can then enforce secondary factors in your global session policy or in an authentication policy.
Identifier-first flow with biometric
If your sign-on policies allow a biometric authenticator, the Sign-In Widget shows an identifier-first page with Okta FastPass optimized.
- The end user goes to your sign-in page.
- The Sign-In Widget displays two options: Sign in with Okta FastPass and the Username field.
- If the end user chooses to sign in with a username, they continue through the steps of the identifier-first flow.
- If the end user chooses Sign in with Okta FastPass, they automatically authenticated through their device enrollment.
If this is the flow that you want for your org, set up Device Trust and create a passwordless authentication policy.