OTP and login flow best practices

Question

I have an identity server that i want to only use its SCIM2 APIs without its login form and other features. From my front end and back end applications, i want to manage the Oauth2 login flow including multifactor authentication. What should be my flow? For example, should i generate a token and save it under my database then after otp validation, i return the token to the front end side? or should i generate the token after otp validation? in the second case, how should i validate the username and password in this case and will i have to store them locally so that i can re-use them to generate a token after otp validation?

Answer 1

In OAuth and OpenID Connect you use an authorization server to do the difficult security work, including token issuing and MFA. Your apps simply run a code flow and receive tokens afterwards.

In this manner you should get a standard architecture and the best security capabilities, with simple code. Eg the ability to use the latest MFA behaviours, such as multi-factor passkeys, WebAuthn and so on. It is not recommended to code lower level authorization server behviours yourself, due to costs and security risks.

When you need to customize behaviour, you use the extensibility features of the authorization server, to execute custom behaviors in the context of a code flow.

This can include capabilities such as redirecting to your own custom screens, calling APIs to validate input or collect custom claims, or looking up users from an external source. You need to choose an authorization server based on your requirements though.