Okta Device Token Behavior in the Authentication API After an OIE Upgrade
Last Updated:
Overview
The following reconfiguration has been identified as part of the preparation needed to perform the upgrade to Okta Identity Engine (OIE). Note that additional Okta features may require reconfiguration or be disabled in order to complete the upgrade. Custom applications utilizing a device token with the Authentication API require updates after an organization upgrades to the OIE. OIE introduces a new method for evaluating device context using Authentication Policies. This new policy-based approach supersedes the legacy method of passing a device token directly to the Authentication API. Administrators must update custom applications to maintain backward compatibility, utilize a redirect-based authentication deployment model, or implement new Software Development Kits (SDKs).
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Application Programming Interface (API)
- Software Development Kit (SDK)
- Custom Applications
Cause
OIE introduces a new method for evaluating device context using Authentication Policies. This new policy-based approach supersedes the legacy method of passing a device token directly to the Authentication API. Review the following image for an example of a device token payload.
For more information, see Request example for trusted application.
Solution
How do administrators update custom applications to manage device context in the Okta Identity Engine?
Update custom applications utilizing the Authentication API to manage device context in OIE by choosing one of the following deployment models.
- Maintain Classic Behavior Temporarily: Leave the Classic Global Sign-on Policy in place. This provides backward compatibility for existing applications while administrators refactor custom sign-in flows. However, new OIE device context features remain unavailable to these applications.
- Replace with a Redirect Model: Update the application to use a redirect-based authentication deployment model. This approach directs users to the Okta-hosted sign-in page, which handles all device context policies automatically.
- Replace with a New SDK: Update the application to use the latest Okta Identity Engine SDKs. The new SDKs handle the device context and policy evaluation flows required by OIE for embedded applications.
