OPA Reports Password Rotated Successfully but The AD Account Password is Unchanged
Last Updated:
Overview
Okta Privileged Access (OPA) reports a successful password rotation for a managed Active Directory (AD) account, but the password in AD remains unchanged because the AD integration lacks Delegated Authentication or password synchronization. Enabling the synchronization feature resolves this issue. This issue occurs when an OPA account rule discovers accounts and the configuration includes the Keep discovered accounts as existing Okta users setting. Okta logs the following System Log event:
(PAM) password rotation finished for a service account SUCCESS
However, the AD agent and Windows System Events show no indication of a password rotation attempt.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Privileged Access (OPA)
- Active Directory (AD)
Cause
The domain's AD integration in Okta lacks Delegated Authentication or the Sync User Password feature. Okta Universal Directory (UD) requires one of these settings to update the account password in AD. Without these settings, OPA updates the Okta user password, but Okta makes no attempt to synchronize the password with the AD account.
Solution
What steps are required to configure Active Directory password synchronization?
Navigate to the Active Directory integration provisioning settings and enable the password synchronization feature to ensure Okta updates the account credentials.
- Navigate to the Active Directory integration in the Okta Admin Console.
- Select the Provisioning tab.
- Choose To App in the left settings menu.
- Enable the Sync User Password option.
NOTE: Enabling Delegated Authentication is a significant change that makes Active Directory act as the source of truth for credential validation. If the integration lacks Delegated Authentication, use the Sync User Password option.
