When users from a specific domain fail to authenticate via Agentless Desktop Single Sign-On (ADSSO), Okta redirects them to the default login page. This occurs because the Okta Active Directory (AD) agent supports communication across domains but not across forests, preventing Okta from validating the Kerberos ticket. Ensure the host server communicates with a Domain Controller in the same forest as the sourced user, and reinstall the Okta AD agent.

In an environment with multiple domains and directory integrations, users from a specific domain fail to authenticate via ADSSO. Okta redirects the user to the default login page and registers an ADSSO redirect event in the System Log. A previous failure for an import topology read for the affected domain causes the authentication failure. The System Log displays the following error:

Perform import topology by AD agent - Failure: Unable to find current domain in the forest. Reason: Forest does not contain domain DC=<domain affected>

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Agentless Desktop Single Sign-On (ADSSO)
• Active Directory (AD)

The Okta AD agent supports communication across domains, but it does not support communication across forests.

How is the Agentless Desktop Single Sign-On authentication failure resolved?

The Okta AD agent must be installed in each forest and in each domain within a forest that contains users intended for import and ADSSO authentication. The host server can reside in a different domain from the users, but it must reside in the same AD forest. Okta AD agents support user authentication across multiple domains within a single forest, but not across multiple forests. The Okta AD agent must communicate with a Domain Controller that belongs to the same forest as the sourced user.

Configure the host server and reinstall the Okta AD agent to trigger a new topology read for the domain by completing the following actions.

1. Ensure that the host server on which the Okta AD agent fails to authenticate with ADSSO can communicate with a Domain Controller in the same forest as the sourced user.
2. Reinstall the Okta AD agent on the host server to allow Okta to trigger a new topology read for the domain.

Related References

• Active Directory integration prerequisites - See OS and software section.
• Integration with existing Active Directory forests and domains. 
• Register multiple domains to an Okta AD agent.