step-up authentication

How should sensitive actions be confirmed for users authenticated through SSO?

I'm adding Google-based SSO to an existing application where sensitive actions currently require the user to re-enter their password, such as changing security settings or performing destructive operations.…

What’s the best way to confirm sensitive actions for SSO users without local passwords?

I'm adding Google-based SSO to an existing application where some sensitive actions currently require the user to re-enter their password, such as changing security settings or performing destructive…