HonkIO Auth

Two-step verification

A passkey, or a code on the channel the user didn’t sign in with. Require it for an app, an organization or a role, and use it for step-up.

The second step

Pro and Business. The second step is a passkey, or a code sent to the channel the user didn’t sign in with: email after a text, a text after email. A passkey sign-in already counts as both steps, so passkey users are never asked for a code too. Once both steps are done, the ID token’s amr includes mfa and its acr is urn:honkio:acr:2fa.

Requiring it

Require it for the whole app with two_step_required on the sign-in policy (Pro and Business), or on Business, for an organization or a role with their own two_step_required. A user signing in to an organization that requires it, or holding a role that does, completes both steps. Required means required: if the user’s second step can’t be used at that moment (texts paused, or over the daily limit), HonkIO offers their passkey if they have one, and otherwise stops with a “can’t finish signing in right now” page. A sign-in never finishes with one step.

First setup

When you turn the requirement on, each user sets up their second step the next time they sign in. Anyone who controls their first channel at that moment can set it up, so turn it on early, before you have many users, or ask users to add a passkey first.

Changing sign-in methods

Once a user has two steps, adding, changing or removing any sign-in method (email, phone or passkey) needs both. Every change is notified to the old email or phone, and ends the user’s sessions.

Step-up for sensitive actions

Before a sensitive action, send the user back through sign-in with acr_values=urn:honkio:acr:2fa and max_age=0. HonkIO asks for both steps again, even within an existing session. Then check the new ID token: acr must be urn:honkio:acr:2fa and auth_time recent.

authorize

https://login.acme.ca/authorize?client_id=hka_xxxxxxxxxxxx
  &response_type=code&scope=openid%20email
  &redirect_uri=https%3A%2F%2Fapp.acme.ca%2Fauth%2Fcallback
  &code_challenge=…&code_challenge_method=S256&state=…&nonce=…
  &acr_values=urn%3Ahonkio%3Aacr%3A2fa&max_age=0
# Then check the ID token: acr == "urn:honkio:acr:2fa" and auth_time is recent.