Okta Agentless Desktop Single Sign-On Fails With Unknown User Error
Last Updated:
Overview
Users experience an authentication failure when attempting to log in to Okta using Agentless Desktop Single Sign-On (ADSSO). This occurs when multiple Active Directory (AD) integrations exist, administrators enable profile source prioritization, and the Kerberos ticket originates from a domain that is not the primary profile source. To resolve this, users must authenticate using a Kerberos ticket from the primary profile source domain. Okta generates the following error in the System Log:
FAILURE: Authentication failed with result=UNKNOWN_USER for client=user@example.com
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Agentless Desktop Single Sign-On (ADSSO)
- Active Directory (AD) Integrations
- Profile Source Prioritization
Cause
The organization has multiple AD integrations, and the user presents a Kerberos ticket from a domain that is not the primary profile source. Because administrators enable the Enforce profile source prioritization when authenticating user logins setting, Okta rejects the authentication attempt. This is expected behavior to ensure strict identity verification.
Solution
How do administrators resolve the Agentless Desktop Single Sign-On authentication failure?
To resolve the authentication failure, ensure the user authenticates with a Kerberos ticket issued by the primary profile source domain. This is the recommended approach.
Alternatively, administrators can turn off the Enforce profile source prioritization when authenticating user logins setting.
Disabling profile source prioritization introduces security risks.
Okta does not recommend disabling the profile source prioritization setting. When administrators disable this setting, Okta may authenticate a user against a secondary or less secure directory if a matching username exists. This creates a risk of unauthorized access or account takeover if usernames overlap across different domains with varying security policies. Enforcing prioritization ensures that Okta only trusts the authoritative source for a specific identity.
