<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7VPhSANOkta Classic EngineAdministrationAnswered2024-04-15T11:53:36.000Z2015-12-15T22:12:12.000Z2019-02-07T19:48:04.000Z

JakeM.92695 (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:20 AM
Delegated authentication - Password caching?
Hello-

 

In a scenario where I have delegated authentication configured, I had an incident where my domain controllers were not available yet my users were still able to log in, even when directly going to the SaaS app (O365 in this case).  Can someone explain how this would still work even when all my DCs are down?

 

Thanks,
  • 2 answers
  • 3.48K views
97f86 and 1y5ca like this.

  • ayee1.3418502845013904E12 (Okta, Inc.)

    Hi Jake,

     

    Thanks for your inquiry. Good question! To mitigate problems of your directory connecting to Okta, we internally persist your directory authenticated (DelAuth) session. This helps in many scenarios - when all DCs go down (as you mentioned), when all Okta AD agents go down, or when connectivity drops.

     

    To ensure system availability and customer access to apps, we store a one-way irreversible hash (SHA-256) of user ID, username, and password from prior DelAuth requests. This is not the hash stored by AD. It's a separate hash that's calculated by and only used within Okta. The hashed session data is cached in our database for 10 days and is valid for authentication for 5 days.

     

    The next time the user logs in, Okta checks the connection to AD. 
    • If available, Okta delegates authentication to the directory. If successful, we update the cached session data and the time stamp. DelAuth requests proceed as normal.
    • If the connection is NOT available, Okta authenticates to the cached session for the remaining time of the 5 day period.
    Expand Post

  • r68q0 (r68q0)

    Hi, do you have this documented somewhere that I can reference? I don;t see it mentioned in the AD Agent documentation.

This question is closed.
Loading
Delegated authentication - Password caching?