Hi everyone, I've been working on a project using Ory Kratos (V1.1.0) for user authentication and management. While the sign-up and sign-in functionalities are working perfectly. Now we want to have OTP validation over email for sign-in flow. I tried different combination of configurations, but it is not woking. Will it work, with vanilla Kratos or do I need to develop custom hooks for it ? I don't find configuration in Kratos yaml specification doc for OTP over email for sign-in. Any advice or guidance on this would be greatly appreciated, thank you 🙏

Hello @shy-wall-7656 You want to send users a 4 digit code that they can use to login? This is the config you need:

selfservice:
  methods:
    code:
      passwordless_enabled: true

Thanks @magnificent-energy-493. Yes, now I can able to login with password or code (sent over email). I want user to first enter valid password and then code (sent over email), then only he/she should be able to sign-in

I don’t believe you can do this purely with Kratos. You would need to build your own API that Kratos can call through a flow interrupting webhook for the

after settings

hook. Your external system would need to store the user’s last 5 password hashes, and reject (return a 40x error) if they reuse it

Hi everyone, I've been working on a project using Ory Kratos (V1.2.0) for user authentication and management. While the sign-up and sign-in functionalities are working perfectly. One of our requirement is to send otp over email for each login flow after correct password is entered even if email id is verified already. How to configure it?

@shy-wall-7656 Hey I would be interested where this NIST best practice regarding password history/restricting password reuse is documented. I looked through the doc and found nothing, but its quite long so I might have missed it. I have been looking at these documents: https://pages.nist.gov/800-63-3/ If possible can you maybe point me to the section? NIST does recommend to do a check against breached passwords, which Ory implements with the haveibeenpwned API by default. This combined with 2-factor auth is a very good protection IMO and preventing the user from reusing their last 5 password is IMO just sugar on top that does not change much regarding security (except mildly annoying the user). The breached password detection will prevent them from using unsafe password.

Yes

Hey @shy-wall-7656 In that case after login check the aal and if it is 1, you redirect the user with the

?aal=aal2

parameter. This will prompt them to input their second factor see the docs here https://www.ory.sh/docs/kratos/mfa/step-up-authentication