Users fail to log in to Okta using a temporary Active Directory (AD) password when Delegated Authentication is enabled because the AD password policy rule in Okta restricts password changes. Grant users the ability to change the AD password through the Okta Admin Console to resolve this issue.
When attempting to log in, the following error appears on the login screen:
Unable to sign in
- Directories
- Active Directory (AD)
- Delegated Authentication
- Password Policy
- Okta Classic Engine
- Okta Identity Engine (OIE)
The Active Directory password policy rule in Okta restricts users from changing passwords and the user's password within Active Directory has expired or User must change password at next logon in set on the AD account.
How is the login error resolved?
Grant users the ability to change the Active Directory password from the Okta login page by modifying the Active Directory Policy rules and verifying service account permissions.
- Grant users the ability to change the AD password through Okta:
- If using the Okta Classic Engine, navigate to Security > Authentication in the Okta Admin Console.
- If using Okta Identity Engine (OIE), select Security > Authenticators, and then select Actions > Edit next to the Password authenticator.
- If using the Okta Classic Engine, navigate to Security > Authentication in the Okta Admin Console.
- Select Active Directory Policy in the left panel.
- Scroll down to the Rules section, and click the pencil icon next to the existing rule, or click Add Rule if only the default rule exists.
- In Okta Classic Engine, select change password, perform self-service password reset, and perform self-service account unlock for the THEN User can setting.
- In OIE, select Password change (from account settings), Password reset, and Unlock account for the THEN Users can perform self-service setting. Ensure that the configuration includes a selected recovery method.
- In Okta Classic Engine, select change password, perform self-service password reset, and perform self-service account unlock for the THEN User can setting.
- Ensure that the rule's status is Active.
- Verify that the Password Settings in the Active Directory Password Policy in Okta match the password policy in Active Directory.
- Ensure the Okta service account has permission to change passwords in Active Directory. If permission changes are made, restart the Okta AD Agent service afterward.
