pd6d0 (pd6d0) asked a question.
Why are users able to sign in using part of their username?
One of my QA colleagues brought to my attention that a user can log into our product (okta authenticated) using part of their username.
For example: If the username was 'testuser@test.com', they were able to login as 'testuser' without the '@test.com' domain.
My questions are:
- Is this expected behavior?
- Is this behavior something that can be turned off?
- If there were more than one username which started with 'testuser', my assumption is that it would force a match on the whole username. Is that true?
This is expected behavior as long as the username prefix (the string before the '@') is unique within your Okta org. If more than one account has the same username prefix and any of those users attempt to log in with only the username prefix, the login attempt will simply fail.