Users with an Existing Okta Session are Prompted for Password after OIE Upgrade

After upgrading to Okta Identity Engine (OIE), users are not automatically logged in while they have a valid session opened before the upgrade.

• OAuth/OpenID Connect
• Self-Hosted or Okta Hosted Sign-in Widget
• Okta Identity Engine (OIE)

We released a fix for the issue on Release version 2023.08.0. Sessions that were created prior to that rollout may not have those password verifications associated with them, and should the org subsequently upgrade to OIE and have authentication policies for their apps that require passwords for assurance, they will be prompted.

Prior to that fix, password verifications on Classic were more implicitly tracked and did not generate the same types of database entries as verifications of other factor types. That change ensured that password verifications began to be tracked in such a way as to be available by the OIE pipeline when evaluating assurance requirements for a given auth flow. It was a go-forward fix and did not retroactively apply to existing sessions.

In addition, if a user authenticates in Classic Engine (which creates a sessionToken), and the upgrade to Identity Engine was completed while the sessionToken is valid (five minutes), then when a user attempts to access an OpenID Connect app after the upgrade, the user is prompted for their password again.
As stated in our documentation.

In conclusion, any user with a session opened within 5 minutes before the OIE upgrade or prior to the deployment of Release version 2023.08.0 on the Okta tenant will be prompted for password on their first connection after the upgrade. This is a limitation on our pipeline.