Okta FastPass prevents seamless application logins and prompts users for an additional authentication factor. This issue occurs when a browser plugin blocks loopback server communication required for phishing resistance, or when the device experiences time skew. Resolve this issue by adding the Okta domain to the plugin's allowlist or by synchronizing the device's time.

• Okta Identity Engine (OIE)
• Okta FastPass
• Multi-factor Authentication (MFA)

Okta FastPass meets the login requirements for applications with policies that require a phishing-resistant possession factor. To achieve phishing resistance, Okta FastPass requires communication with a loopback server installed on the device. Browser plugins, such as ad blockers, block signals from Okta FastPass and prevent the factor from being recognized as phishing-resistant. This forces a login loop until the authentication process receives a phishing-resistant factor. Additionally, a time skew between the user device and the main server causes a similar login loop.

What steps resolve the Okta FastPass login loop?

Verify the browser plugin issue.

Verify the browser plugin issue by disabling the plugin, testing the login, and reviewing the System Log for successful authentication events using these steps:

1. Disable the browser plugins (for example, uBlock Origin) and initiate a login attempt.
2. Search the System Log for a relevant event by using the following query:
   eventType eq "user.authentication.auth_via_mfa"
3. Expand the details of a successful authentication event, expand the Target section for Okta Verify, and check the MethodTypeUsed for Use Okta FastPass and MethodUsedVerifiedProperties for PHISHING_RESISTANT.

Review the following image for an example of an expanded successful authentication event:

If disabling the plugin allows a successful login with Okta FastPass, edit the blocklists or allowlists in the plugin settings.

Add the Okta domain to the uBlock Origin allowlist.

Add the Okta domain to the uBlock Origin trusted sites list by following these steps:

1. Open the settings in the uBlock Dashboard.

Review the following image for an example of the uBlock Dashboard settings:

2. Go to the Trusted Sites tab.
3. Add the relevant URL (for example, <subdomain>.okta.com).
4. Click Apply Changes.

Review the following image for an example of the Trusted Sites tab:

How does uBlock Origin recreate this behavior?

Replicate this behavior with the uBlock Origin browser plugin in Chrome or Firefox by following these steps:

1. Open the settings in the uBlock Dashboard.

Review the following image for an example of the uBlock Dashboard settings:

2. Click Filter Lists.
3. Expand Privacy.
4. Select the checkbox for the Block Outsider Intrusion into LAN list.
5. Click Apply Changes.

Review the following image for an example of the Block Outsider Intrusion into LAN checkbox:

Synchronize the device time to resolve time skew issues.

Synchronize the time on a Windows device by following these steps:

1. Open the Start menu and click Settings.
2. Click Time & Language on the Settings dialog box.
3. Scroll to the Related Settings section and click Additional date, time & regional settings.
4. Click Date and Time on the Clock and Region screen in the Control Panel.
5. Click the Internet Time tab on the Date and Time dialog box.
6. Click Change settings.
7. Check the Synchronize with an Internet Time server box on the Internet Time Settings dialog box.
8. Select a server from the dropdown menu. If the server is not listed, enter the name of an Internet time server.
9. Click Update now.

Synchronize the time on a macOS device by following these steps:

1. Choose the Apple menu and select System Settings.
2. Click General in the sidebar, then click Date & Time on the right.
3. Turn on Set time and date automatically, select Set, then enter a network time server for the region.
4. Turn on Set time zone automatically using your current location.

Synchronize the time on an iOS device by following these steps:

1. Navigate to Settings, select General, and choose Date and Time.
2. Select Set Automatically.

Synchronize the time on an Android device by following these steps:

1. Navigate to Settings and select Date & Time.
2. Select Automatic.

NOTE: 

• When the blocking plugin is uBlock Origin, either add <subdomain>.okta.com to the allowlist or clear the Block Outsider Intrusion into LAN setting to use Okta FastPass successfully.
• If using Safari, Okta FastPass requires an initial trigger from Chrome to function correctly in Safari afterward.

Related References

• A Deep Dive Into Okta FastPass