Okta Sign-In Widget Displays Generic "Invalid Credentials" Error for Locked Accounts

When a user account is locked, such as due to too many incorrect password attempts, and the user subsequently attempts to log in with the correct password, the Okta Sign-In Widget displays a generic error message. The widget does not explicitly state that the account is locked, which can confuse the end-user. Enabling the Show lockout failures setting in the relevant Okta Password Policy resolves this issue and ensures users see a specific account locked message. When this failure occurs, Okta generates one of the following error messages:

Unable to sign in

Invalid username/password

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Authentication
• Sign-In Widget
• Multi-Factor Authentication (MFA)

This behavior occurs when the Show lockout failures option is disabled in the Password Policy rule that applies to the user. For security purposes, to prevent potential account enumeration or harvesting, the default Okta behavior returns a generic authentication failure message. The more specific account locked error is only returned by the Application Programming Interface (API) and displayed in the widget if this setting is explicitly enabled.

How is the locked account message shown in the widget?

Enable the Show lockout failures setting in the relevant Okta Password Policy to ensure users see a specific account locked message.

1. Log in to the Okta Admin Console.
2. Go to Security > Authentication.
3. Select the Password policy tab.
4. Identify the policy that applies to the affected users, such as the Default Policy, and select its name.
5. Select Edit.
6. Scroll down to the Lock out section.
7. Select the Show lockout failures checkbox.
8. Select Update Policy to save the changes.

After enabling this setting, users attempting to sign in to a locked account see a message indicating their account is locked, providing a clearer user experience.