VerifiedKnock · Documentation

Okta lost security key recovery with help-desk and supervisor approval

When an employee loses their FIDO2 security key or passkey, an Okta Temporary Access Code lets them sign in once and enroll a new authenticator. VerifiedKnock makes sure two people approve before that code is created: a branch supervisor who checks the employee in person, and a separate help-desk agent. Each approves with their own FIDO2 security key. Okta support is in early access.

How the recovery works

1. The branch supervisor checks the employee in person. The employee meets an authorized branch supervisor. Your organization decides how the supervisor identifies the employee. The supervisor starts the request in VerifiedKnock and approves with their own FIDO2 security key.
2. The employee confirms their own phone. The employee scans a QR code with their own phone, in a browser that is not signed in to the VerifiedKnock console. The phone shows a 6-digit code. The employee reads it back to the supervisor, who enters it to confirm the right phone is connected. The code expires after 15 minutes and allows a limited number of tries.
3. A separate help-desk agent approves. An authorized HQ help-desk agent, a different person from the supervisor, reviews the request and approves with their own FIDO2 security key. Both approvals are required.
4. VerifiedKnock requests a short-lived pass. Only after both approvals, VerifiedKnock asks the identity provider for a single-use, short-lived Okta Temporary Access Code and delivers it only to the employee’s phone. Neither approver sees it.
5. The employee registers a new key. The employee uses the pass to sign in and register a new security key or passkey.
6. Everything is recorded. Each step, approver, key and result is written to the audit trail.

How this compares with other approaches

• A help-desk agent resets the account alone. One person decides, often over the phone. VerifiedKnock requires an in-person check by a supervisor and a second approval by a different person, each with their own key.
• Build it yourself with Okta Workflows or scripts. You can create Temporary Access Codes through the Okta API. You then build and maintain the approval rules, delivery of the code, phone confirmation and audit trail yourself. VerifiedKnock provides these as a ready workflow.

Setup

Connect your Okta org using the Okta setup guide, which lists the scopes and the Temporary Access Code settings.

Questions

Questions or a pilot: [email protected]. See also Help-desk account recovery.