Okta Users in One-Time Password Mode Can Still Access Applications
Last Updated:
Overview
A user in One-Time Password mode can still access external applications through a Service Provider (SP) flow without resetting their password. This occurs because the user has not authenticated directly into Okta since their status changed, leaving their password unexpired for external access. To resolve this, the user must log into the Okta Dashboard directly to trigger the password reset prompt and change their status to Active.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Users
- Password Policy
- Applications
- Login
Cause
The user did not authenticate directly into Okta after their status changed. This results in the user not having an expired password, allowing them to still access external applications through a Service Provider (SP) flow.
Solution
How is the One-Time Password mode issue resolved?
Resolve the One-Time Password mode issue by instructing the user to log into the Okta Dashboard directly and set a new password.
- Instruct the user to log into the Okta Dashboard directly.
- Ensure the user sets a new password when Okta prompts them.
- Verify that the user status changes from One-time password to Active.
How can administrators track this authentication event in the System Log?
Track the authentication event in the System Log by locating the Okta Dashboard ID and User ID, and executing the provided query.
- Locate the Okta Dashboard ID in the application page URL.
- Locate the User ID in the URL when accessing the User Profile page.
- Navigate to the System Log and search using the following query:
target.id eq "<Okta_Dashboard_Application_Id>" and eventType eq "user.authentication.sso" and actor.id eq "<User_Id>"
