Okta Sign-In Widget Displays Generic Invalid Credentials Error for Locked Accounts

The Okta Sign-In Widget displays a generic error message for locked accounts because administrators leave the Show lockout failures option cleared in the Password Policy. Enabling the Show lockout failures setting in the relevant Okta Password Policy resolves this issue and ensures end-users see a specific account locked message. When Okta locks an end-user account due to too many incorrect password attempts and the end-user subsequently attempts to sign in with the correct password, Okta generates one of the following error messages:

• Unable to sign in
• Invalid username/password

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Authentication
• Sign-In Widget
• Multi-Factor Authentication (MFA)

This behavior occurs when administrators clear the Show lockout failures option in the Password Policy rule. For security purposes, to prevent potential account enumeration or harvesting, Okta returns a generic authentication failure message by default. The Application Programming Interface (API) returns the more specific account locked error and displays it in the widget only if administrators explicitly enable this setting.

How does the widget show the locked account message?

Enable the Show lockout failures setting in the relevant Okta Password Policy to ensure end-users see a specific account locked message.

Configure the Okta Classic Engine password policy.

Enable the Show lockout failures setting in the relevant Okta Password Policy from the Okta Admin Console to ensure end-users see a specific account locked message.

1. Log in to the Okta Admin Console.
2. Go to Security > Authentication.
3. Select the Password policy tab.
4. Identify the policy that applies to the affected end-users, such as the Default Policy, and select the policy name.
5. Select Edit.
6. Scroll down to the Lock out section.
7. Select the Show lockout failures checkbox.
8. Select Update Policy to save the changes.

Configure the Okta Identity Engine(OIE) password policy.

Enable the Show lockout failures setting in the relevant Okta Password Policy from the Okta Admin Console to ensure end-users see a specific account locked message.

1. Log in to the Okta Admin Console.
2. Go to Security > Authenticators.
3. Select Edit next to Password.
4. Identify the policy that applies to the affected end-users, such as the Default Policy, and select the policy name.
5. Select Edit.
6. Scroll down to the Lock out section.
7. Select the Show lockout failures checkbox.
8. Select Update Policy to save the changes.

Review the image to see the location of the Show lockout failures checkbox in the Okta Admin Console.

After enabling this setting, end-users attempting to sign in to a locked account see a message indicating that Okta locked the account.