Remote Desktop Protocol (RDP) connections to a Windows server via the Okta Advanced Server Access (ASA) Active Directory (AD) joined passwordless flow fail when Domain Controllers enforce strict certificate-based authentication. Resolve this issue by configuring the team settings to include the user Security Identifier (SID) in the certificate and ensuring user sync jobs run successfully.

The RDP connection fails with the following error:

Your credentials could not be verified

Inspecting the Kerberos communication between the target server and the authenticating Domain Controller (DC) reveals the following Kerberos error:

KDC_ERR_CERTIFICATE_MISMATCH

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Remote Desktop Protocol (RDP)

Windows enforces strict attributes for certificate-based authentication. When Domain Controllers (DCs) operate in Full Enforcement Mode, they reject the certificate during Kerberos authentication because Okta Advanced Server Access omits strong certificate mappings by default.

How is the credentials could not be verified error resolved?

Resolve the credentials error by configuring the team settings to include the user Security Identifier (SID) in the certificate, verifying the user sync jobs, and matching the User Principal Name (UPN) format by following these steps.

1. Configure the Team Settings in Okta Advanced Server Access to include the user SID in the certificate. Review the Team Settings documentation for more information.
2. Ensure the user sync job(s) run successfully and match all Okta Advanced Server Access users. Okta Advanced Server Access requires this step to obtain and use the SID in the certificate.
3. Verify that the active directory passwordless identity attribute value for users matches the exact UPN format expected by Active Directory, including case sensitivity (for example, <user> versus <user>@<domain>).
4. If the UPN does not match, Okta generates the following error:

userSID is required for creating x509 certificate with includeSID=Always

5. Add the domain for all users by modifying the Okta Expression Language (OEL) expression in the attribute mapping from the Active Directory connection to the Okta profile attribute mapped to the Okta Advanced Server Access passwordless identity attribute, and force a sync. For example, modify the OEL expression in the setup doc from Arrays.add(Arrays.toCsvString({}),appuser.userName) to Arrays.add(Arrays.toCsvString({}),appuser.userName + "@domain.com").
6. If the issue persists, set the enforcement back to Compatibility mode on the Windows side to support the default Okta Advanced Server Access certificates. Consult Microsoft documentation for details on setting this mode.

Related References

• KB5014754: Certificate-based authentication changes on Windows domain controllers- KB not found for server 2022 or 2019
• Team Settings
• user sync job(s)
• setup doc