I have 2 applications that are integrated together (in both apps there is a button that will redirect to the other application). We can also log into the applications independently (there are 2 separate urls for users that do use and do not have access to both applications).
I would like to set a rule that will not prompt MFA for users that are accessing an application when within the other application).
I have the following rule:
function (user, context, callback) {
// TODO: implement your rule
var CLIENTS_WITH_MFA = ['{second app cliendID}];
// run only for the specified applications
if (CLIENTS_WITH_MFA.indexOf(context.clientID) !== -1) {
context.multifactor = {
provider: 'none',
};
// }
}
This works fine for one application but it also removes MFA for users that only use the second application (they are not prompt to enter MFA anymore when they log in directly from the second application).
Is there a way to remove MFA prompt when switching between applications in-app without removing the MFA prompt when user logs in directly in the second application (through the second application login page)