When Okta is connected as an Identity Provider (IdP) to Citrix Cloud, Citrix Cloud unexpectedly prompts users to re-enter their password. This issue occurs because Citrix Cloud includes the prompt=login parameter in the /authorize request sent to Okta. Resolving this requires contacting Citrix Technical Support to disable the setting that sends this parameter.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Citrix Cloud
• OAuth 2.0
• OpenID Connect (OIDC)

Citrix Cloud includes the prompt=login query parameter in the /authorize request generated to Okta. This parameter forces Okta to prompt the user for authentication, regardless of whether an active Okta session exists.

How is the password prompt issue resolved?

Contact Citrix Technical Support to disable the setting responsible for sending the prompt=login parameter in the /authorize request generated to Okta.

Removing the prompt parameter completely restores the standard authentication behavior, which proceeds as follows:

• If an Okta session already exists and meets the application's assurance requirements, Okta silently authenticates the user.
• If an Okta session does not exist, Okta prompts the user to authenticate.
• If scopes are requested that require consent and consent has not yet been given by the authenticated user, Okta prompts the user to give consent.

Related References

• Citrix: Cloud Workspace OIDC Users Prompted to Login Again for SSON
• Citrix: User Prompted for Additional Credentials on Workspace URLs When Using Federated Authentication Providers
• Authorization Code Flow 
• The /authorize request
• Prompt parameter