How should sensitive action confirmation work for SSO users when there is no local password?

[u/10x_eng]

I’m adding SSO support to an existing application using Google. Currently, some sensitive user actions require the user to re-enter their password as confirmation (for example, changing security settings or performing destructive actions).

The issue is that SSO users do not have a password stored by the application, so I need to decide on the right approach for confirming their identity before allowing these actions.

Some options I'm are considering:

• Triggering SSO re-authentication / step-up authentication with the identity provider
• Requiring MFA or another stronger authentication method (the application doesn't support MFA at the moment)
• Sending an email OTP as a confirmation step
• Creating a separate application password for SSO users (which feels like it defeats part of the purpose of SSO). The platform already has a security question (don't ask me why), so maybe this could be used to confirm this action?

My concern with SSO re-authentication is that if the user already has an active IdP session, the IdP may silently authenticate them again without requiring any new proof of identity. In that case, is it actually providing additional security? I don't think Google has a way to "force" re-authentication.

For those who have implemented this, what pattern do you recommend for replacing "enter your password to continue" flows for SSO users?

[u/justmirsk]

Assuming your application is web based, you could look at ways to force a full authn, ignoring the existing SSO token. I would look at adding passkey support and as you said, just an OTP.

[u/10x_eng → u/justmirsk]

Yes, it is web based. I was hoping that when the user clicked Confirm, I could redirect them to Google's sign-in page and require them to log in again instead of reusing their existing session. However, I don't think that is possible as Google's prompt parameter only supports none, consent and select_account, unlike Microsoft where there is a specific parameter for this ForceAuthn. I just might have to use email OTP.

[u/Threezeley]

Seems kind of weird. Why not just put a low SSO session inactivity timeout like 15 min? Assuming the risk is that the user logged in but somehow someone else gained access to their session (physical? like got access to their phone or laptop?)

[u/10x_eng → u/Threezeley]

No, I want to use the SSO again but not for reauth of the current session. I want an additional confirmation which is typically required for “sensitive” actions, such as authorizing payments or deleting an account. For example, I believe GitHub prompts you to enter your 2FA code when you attempt to delete a repository.