Also you should check out the forgot password authn interception script:
[https://github.com/GluuFederation/oxAuth/tree/master/Server/integrations/forgot_password](https://github.com/GluuFederation/oxAuth/tree/master/Server/integrations/forgot_password)
It may be weird to think about "forgot password" as an authentication flow... but it actually is. In fact, it's the default authn flow for many websites, because people never remember their passwords anyway.