Okta Org2Org FastPass AuthMethod Claim Missing in Downstream Policy Evaluation

When an Okta Org2Org integration features a Service Provider (SP) configured with Claims Sharing to trust claims from the Identity Provider (IdP), an Okta Verify FastPass authentication from the IdP drops from the AuthMethod claims list. This occurs due to a policy misalignment regarding user interaction requirements between the IdP and SP, and administrators resolve it by aligning the authentication policies in both environments. As a result of this misalignment, the end user encounters an unexpected authentication challenge within the SP organization because the provided claims fail to meet downstream policy requirements.

• Okta Identity Engine (OIE)
• Org2Org with "Trust claims" enabled on the Service Provider (SP) organization
• Okta Verify FastPass signed_nonce AuthMethod claim
• Authentication Policy User Interaction Requirement
• Passwordless User Experience

A misalignment of the Require user interaction setting between the IdP and SP organization authentication policies causes this behavior. The user federates automatically via a passwordless flow from the IdP if the policy allows, but Okta challenges the user downstream within the SP organization if the provided claims fail to satisfy the policy requirement. This behavior is expected and secure.

Review the upstream IdP Org2Org policy and the System Log event to confirm that passwordless authentication with FastPass occurs without requiring user interaction and that Okta automatically federates the user.

Review the downstream SP organization default application policy and the System Log for the policy evaluation challenge to confirm the user interaction requirement and that the signed_nonce AuthMethod claim does not appear.

How is the policy misalignment resolved?

The resolution depends on the desired user experience. Configure the authentication policy to either require or not require user interaction based on the organizational requirements.

• If users must authenticate with additional user verification, set the IdP Org2Org application authentication policy to require user interaction.
• If users must use FastPass to seamlessly authenticate between tenants and applications without user interaction, set the downstream policy to not require user interaction.

Review the authentication policy rule configuration to verify the user interaction requirement setting.