One more question -- when using MFA the `create_new_session` call will get the `user_id` from the la...

execreate

10/19/2022, 10:19 AM

One more question -- when using MFA the

create_new_session

call will get the

user_id

from the latest recipe used in MFA flow, is that right? So how do I override the

user_id

to contain the ID from the very first recipe in my MFA flow?

execreate

10/19/2022, 10:22 AM

For instance, I am using Passwordless OTP as first factor and EmailPassword (PhoneNumberPassword actually) as the second factor. I want my users to have the Passwordless recipe

user_id

. I can get that ID this way:

Copy code

python
passwordless_user_id = get_user_by_phone_number(old_session.get_access_token_payload().get("phoneNumber")).id

And then is it enough to pass that ID to

original_implementation_create_new_session

user_id

nkshah2

10/19/2022, 10:23 AM

Right one way to do this is to check if a session already exists when the PhonenumberPassword sign in/up is called. If it does exist then you can get the user id from the session

nkshah2

10/19/2022, 10:23 AM

You would need to override the api for this, and then you pass the existing user id as user context when calling the original function

nkshah2

10/19/2022, 10:24 AM

Then in create_new_session the user id should be present in the user context, you can then override that function and use the value from user context to set a user id for the session

nkshah2

10/19/2022, 10:24 AM

https://supertokens.com/docs/emailpassword/advanced-customizations/user-context

nkshah2

10/19/2022, 10:24 AM

If you need help with specifics we can get on call and I can help

execreate

10/19/2022, 10:26 AM

Totally forgot about the user-context, thanks! So I assume passing the desired user_id into the

original_implementation.create_new_session

should be fine I think I'm almost there with my implementation 🙂

nkshah2

10/19/2022, 10:26 AM

Yep that should work

execreate

10/19/2022, 10:47 AM

One more question -- global claim validator

SecondFactorCompletedClaim.validators.has_value(True)

does not fail if token does not contain the claim at all, is that right?

nkshah2

10/19/2022, 10:48 AM

@KShivendu can answer that better

rp_st

10/19/2022, 10:57 AM

It will try and fetch the claim value from the second factor claim first, and then based on that, it will check if that claim is true or not.

rp_st

10/19/2022, 10:58 AM

The fetch value function on second factor claim returns false I think. So if the claim is not defined, it will first call the fetch value function, which will set it to false, and then it will check if the value is true or not - in this case, failing

execreate

10/19/2022, 11:03 AM

@rp_st Thanks a lot 🙂

2 Views

Previous Next

SuperTokens.com

SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).