Missing "keep-me-signed-in" Remediation in IDX Flow with Okta Auth JS SDK

[ahrarsyed]

Describe the bug

We are experiencing a problem with the IDX remediation flow using the Okta Auth JS SDK. Specifically, the remediation option for "keep-me-signed-in" (KMSI) is not available, even when the policy permits KMSI for the user.
When attempting to skip the enrollment of a second factor using idx.proceed({ skip: true }), we encounter an AuthSdkError with the message: "No remediation can match current flow, check policy settings in your org. Remediations: [keep-me-signed-in]." Despite a 200 response from the network indicating success, the SDK interprets this as a failure.

Reproduction Steps?

• Sign in using the IDX remediation flow with Okta Auth JS SDK.
• Begin the MFA enrollment process with two factors.
• Successfully enroll one factor.
• Attempt to skip the enrollment of the second factor using idx.proceed({ skip: true }).
• Observe the AuthSdkError and the discrepancy between the network response and SDK behavior.

SDK Versions

7.14.1

Additional Information?

The issue seems related to the availability of the "Keep Me Signed In" (KMSI) remediation option.
It looks like the same issue with KMSI is encountered when the user is prompt for MFA challenge and successfully verifies the passcode. The next remediation step being KMSI throws the same AuthSdkError.
The error message suggests checking policy settings, but the policy does allow KMSI.
We would like to verify if there is a remediator for KMSI in the SDK. If not, we seek guidance on what could be done to handle this scenario effectively.

[jaredperreault-okta]

I am working on addressing this situation and others like it in version 8.x. Until then you should be able to proceed by explicitly passing step: keep-me-signed-in

oktaAuth.idx.proceed({ step: 'keep-me-signed-in', keepMeSignedIn: false });

In fact, I recommend always providing the step param (the name of the remediation you wish to "invoke")

[ahrarsyed]

I am working on addressing this situation and others like it in version 8.x. Until then you should be able to proceed by explicitly passing step: keep-me-signed-in

oktaAuth.idx.proceed({ step: 'keep-me-signed-in', keepMeSignedIn: false });

In fact, I recommend always providing the step param (the name of the remediation you wish to "invoke")

Thanks for the reply. The issue is that the response from the skip remediation step itself triggers an AuthSdkError, preventing us from capturing the KMSI remediation step in that response. If the skip response included a KMSI remediation step, we could use your previously provided solution to invoke this - oktaAuth.idx.proceed({ step: 'keep-me-signed-in', keepMeSignedIn: false }); and proceed further.

[jaredperreault-okta]

Apologizes I think I misunderstood your question. I believe the see the issue now

As I mentioned before, I am working to improve the remediation logic in 8.x to prevent situations like this from occurring

Luckily, the following may work as a work around. Can you try

oktaAuth.idx.proceed({ skip: true, useGenericRemediator: true });

[ahrarsyed]

Apologizes I think I misunderstood your question. I believe the see the issue now

As I mentioned before, I am working to improve the remediation logic in 8.x to prevent situations like this from occurring

Luckily, the following may work as a work around. Can you try

oktaAuth.idx.proceed({ skip: true, useGenericRemediator: true });

I tried the above and it doesn't seem to work as I don't see the skip call within the browser network tab and the sdk method response for oktaAuth.idx.proceed({ skip: true, useGenericRemediator: true }); returns the same remediation as the earlier sdk method response i.e. in my case the select-authenticator-enroll step. Please advice if there is something else we could do instead. Thanks

[jaredperreault-okta]

Going back to my earlier advice "it's always best to include step".

Try this, if it doesn't work I'll treat this as a bug

oktaAuth.idx.proceed({
  step: 'skip',
  skip: true,
  useGenericRemediator: true
});

[ahrarsyed]

Thanks for the response. We just checked and looks like this is working - oktaAuth.idx.proceed({ step: 'keep-me-signed-in', keepMeSignedIn: 'false', useGenericRemediator: true });

[ahrarsyed]

Hello, we're encountering a recurring issue with the AuthSdkError related to KMSI remediation, but this time it's occurring during the 'challenge-authenticator' step. When we attempt to verify the passcode using the following invocation:

await client.idx.proceed({ step: 'challenge-authenticator', stateHandle: stateHandle, verificationCode: code, useGenericRemediator: true });

We receive the same remediation step, 'challenge-authenticator', as the next step.

However, if we proceed with:
await client.idx.proceed({ verificationCode: code, stateHandle });

We encounter an AuthSdkError with the message: "No remediation can match current flow, check policy settings in your org. Remediations: [keep-me-signed-in]"

Could you please advise on how to resolve this issue? Thank you.