End-user experience for the NFC authenticator

Learn what end users experience when they enroll their NFC-enabled badge and sign in to apps on managed devices with the Near Field Communication (NFC) authenticator.

Early Access release. See Enable self-service features.

How NFC works

When an end user taps their badge, the following actions take place:

Okta Verify, which runs on the managed device, reads the unique ID of the NFC badge.
Okta Verify checks the enrollment status of that badge.
If the badge is enrolled, the Sign-In Widget prompts the end user for their PIN.
If the badge isn't enrolled, Okta Verify prompts the end user to return to the browser and sign in to their Okta account with their existing credentials to set up NFC.

For the enrollment flow, the device is identified as a managed, trusted workstation. The end user needs to provide their PIN only and they don't need to enter a username.

Enrollment experience

The enrollment flow consists of the following steps:

The user verifies their identity by using an existing method, for example, password or security question.
After they sign in, the user is prompted to enroll the NFC authenticator, as configured in the authenticator enrollment policy.
The user completes identity verification or provides another authentication method, as configured in the Okta Account Management Policy.
The user is prompted to open Okta Verify and after that, to tap their NFC badge against the reader.
Okta Verify reads and registers the NFC's unique ID.
The user is prompted to return to the Sign-In Widget in their browser to set their PIN.
The user creates a PIN with the length that you defined when you configured the user experience settings in the NFC authenticator.
The user enters the PIN again to confirm. Enrollment is complete and the user is signed in.

After enrollment, the user can sign in to any app for their role that requires NFC authentication by tapping their badge and entering their PIN.

Note:

Each NFC badge is associated with a single user in a single Okta org. A user can have only one active NFC badge enrolled at a time. Non-cloneable cards can be used only once. After a user unenrolls their card, the cards can't be used again.

Sign-in experience

The sign-in flow consists of the following steps:

On the Sign-In Widget, if you enabled Sign in with NFC, the user clicks the button.
When prompted by Okta Verify, the user taps their NFC badge on the reader.
Okta Verify reads the NFC badge, and if the scan is successful, Okta Verify closes.
The user goes back to their browser to enter their PIN.
If the PIN entry is successful, the user is signed in.

Account recovery

If the user enters an incorrect PIN five times, or if the authentication flow times out, their account is temporarily locked. To regain access, the user can wait for the lockout period of five minutes to expire and try again, or they can reset their PIN.

The Okta Account Management Policy controls PIN recovery assurance requirements. By default, this policy governs recovery for all authenticator types. To define requirements specific to PIN recovery for the NFC authenticator, rather than applying the same rule to all recovery actions, you can create a rule with a custom expression, such as: accessRequest.operation == 'recover' && accessRequest.authenticator.key =='nfc_pin'

See Add a rule for password recovery and account unlock for steps about adding a rule.

You may need to deactivate a user's badge due to personnel status changes or if the badge is lost, damaged, or stolen. In this case, you reset the NFC authenticator from the user's profile and provision a new NFC badge. Then the user goes through the sign-in flow with the new badge to enroll again.