
j5v7c (j5v7c) asked a question.
Hello there - we've been using Okta successfully for a while and are embarking on some discovery with the self-service password reset functionality.
We are AD Mastered, and the service account has the correct permissions to change AD passwords. Codes can be sent to registered SMS device and this has been tested without issue. The main thing I think I'm missing is: Where the reset password on the Okta Mobile App? I don't see a link and if I provide correct org name and ID but wrong password, it just dumps back to Sign In page without option to reset.
On a mobile browser, I can access link and everything works as envisioned. Is there a reason a reset link is not provided for Okta Mobile? I'd like to get user comfortable with a one-stop app, vs: go here for *this* use-case...
Original Author: Jody Tyrus
Hey Ed,
So to be clear, what we have recently released is the ability to change your AD password from Okta Mobile. You must know your current AD password to execute that flow. We have not introduced a "Forgot my password" flow into Okta Mobile yet. There are security considerations that must be addressed in order to safely execute that flow. If the phone is lost or stolen and unlocked, then a malicious agent would have access to both email and MFA to make an unauthorized password change. Once we introduce Touch ID or other non-device dependent auth gate then we will begin to look at "Reset my password" from the device.
Original Auhtor: Arturo Hinojosa, Okta