When a user enters their company username and password on the OKTA login page of their company dashboard so he/she can get access to apps on the OKTA dashboard as show below:

What OAuth flow/protocol is used? Is this an authentication code flow with PKCE that returns an identity token that is later sent to the OKTA dashboard backend?

Thanks

CodePudding user response：

it could be either SAML or OIDC. If it is OIDC, it usually implements authorization code flow with or without PKCE.

CodePudding user response：

It's OIDC app, which uses authorization_code flow with PKCE. You can inspect your network tab while logging in, to find the following request https://redacted.oktapreview.com/oauth2/v1/authorize?client_id=redacted&code_challenge=GpFYQtoQXn1S1NtDJCZGTIQ8x0LSazjZJzE4KQvwPM0&code_challenge_method=S256&nonce=KLn05YhdZ87nJ4Jpbrxauo4oJQeaSV8ZLIVlBeiJT6eQSnvhuun6hvSYbE3E3dBr&redirect_uri=https://redacted.oktapreview.com/enduser/callback&response_type=code&state=If1z2jR0yCJunv0oXdzlxxAAMIoyNFsVpAuXSjZnSW5tE7vMJIL8EQEBMWqZL8xN&scope=openid profile email okta.users.read.self okta.users.manage.self okta.internal.enduser.read okta.internal.enduser.manage which clearly supports my statement