Add Step

Summary

The tutorial shows how to add OAuth 2.0 Step Up Authentication Challenge support to an Angular frontend and NestJS backend, so sensitive routes and API resources can require stronger authentication than ordinary access. It starts from a Lerna monorepo, configures an OAuth 2.0/OpenID Connect single-page application, and uses Okta libraries plus an Okta JWT Verifier to establish the basic authenticated app. The implementation checks authentication assurance through token ACR claims, returns the standard insufficient_user_authentication error when an API request lacks the required assurance, and uses Angular interceptor and application-code handling to redirect with acr_values before retrying. It also describes authentication recency through max_age and auth_time, while noting that the original Okta CLI instructions no longer work exactly as written after the May 2025 account-plan change.

Takeaways

1. 1

   The Step Up Authentication Challenge protocol supports conditional authentication requirements, including authentication mechanism strength and authentication recency.

2. 2

   The NestJS API can check an access token’s ACR claim and respond with insufficient_user_authentication when the requested resource needs stronger authentication.

3. 3

   Angular handles a step-up response by reading acr_values, preserving the current route, redirecting for authentication, and re-requesting the resource afterward.

FAQ