Unable to Authenticate to Okta Due to Expired Active Directory Account
Last Updated:
Okta Classic Engine
Directories
Okta Identity Engine
Overview
Users are unable to log in to Okta via Delegated Authentication with Active Directory (AD) because their AD accounts have expired. To resolve this issue, update the account expiration date in AD to a future date or set it to never expire. When this issue occurs, the following error appears in the System Log:
Authenticate user with AD agent
FAILURE: Authentication failed: account is expired
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Delegated Authentication
- Active Directory (AD)
Cause
This error is a direct response from the Domain Controller and occurs when a user's Active Directory (AD) account expiration date has passed.
Solution
How is the expired account error resolved?
To resolve the authentication issue, navigate to the user account properties in Active Directory and update the account expiration date.
- Navigate to the user account in Active Directory.
- Select Properties for the account and click the Account tab.
- Update the Account expires date to a future date or change it to Never.
- Click OK to save the changes to allow the user to authenticate to Okta.
