<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D51Y00006PHGFwSAPOkta Classic EngineAdministrationAnswered2019-07-17T04:54:32.000Z2019-07-01T22:57:50.000Z2019-07-17T04:54:32.000Z

PeterA.55388 (Customer) asked a question.

July 1, 2019 at 10:57 PM
Self Service Password Reset - Issues

Hi Okta-ers,

 

We're currently using Delegated Auth with AD successfully, but are looking to implement Self Service Password recovery functionality.

I've followed the steps outlined here to grant our service account the necessary permissions to reset user passwords: https://help.okta.com/en/prev/Content/Topics/Directory/ad-agent-install.htm

 

The experience I am seeing during testing is as follows:

 

  1. Attempt a password reset
  2. Receive password reset email
  3. Answer security question
  4. Set new password
  5. Be prompted for my factor
  6. ---It is at this point that the AD account for my account is set to 'User must change password at next logon'---
  7. Be prompted to enter the password I have just set as the 'old password', and re-enter and confirm a new password

This is an awful user experience, and I hope it's not expected behaviour.

 

Does anyone have Self Service Password recovery setup and working on their tenant? Is there something outside of the documentation I am missing?

When our service account is added to 'Domain Admins', this functionality works as expected without a second password reset needed.

 

Thanks in advance,

Peter

  • 2 answers
  • 3.92K views

  • adina.enache1.5163241265230361E12 (Vendor Management)

    Thank you for reaching out to Okta support today,

     

     

     

    The enforcement and requirements for your AD mastered users come from your Active Directory. 

     The Active Directory policy settings in Okta should match your AD only to ensure the necessary prompts appear when a user is not adhering to the policy you have configured.

     Your admins should be resetting AD passwords in AD, if that is what you've chosen for authentication. 

     If you're pushing passwords from Okta > AD, then they can send the end user a password reset link from the Okta admin console, or use the Okta API to reset the password directly.

     For more, check out our documentation on Security Policies from the Help site. If you'd like to discuss in more detail, feel free to open a case with Okta support.

    Expand Post
    Selected as Best

  • PeterA.55388 (Customer)

    I've narrowed this down to the service account not being able to write to the 'pwdLastSet' attribute in AD.

    It should be writing -1 to this value to pull the current time/date from the DC when the password is set by the Okta service account, which has the necessary delegate access to perform that task in our domain.

    However, on password reset via Okta, after I've answered the security question during recovery, this value is set to 0. The user is then prompted to set a password again for the second time.

     

    This doesn't prove to be an issue if the service account is a Domain Admin.

    I've tested this with a user that resides in the OU structure where delegate access has been setup.

     

    Any experience shared would be much appreciated!

    Expand Post

  • adina.enache1.5163241265230361E12 (Vendor Management)

    Thank you for reaching out to Okta support today,

     

     

     

    The enforcement and requirements for your AD mastered users come from your Active Directory. 

     The Active Directory policy settings in Okta should match your AD only to ensure the necessary prompts appear when a user is not adhering to the policy you have configured.

     Your admins should be resetting AD passwords in AD, if that is what you've chosen for authentication. 

     If you're pushing passwords from Okta > AD, then they can send the end user a password reset link from the Okta admin console, or use the Okta API to reset the password directly.

     For more, check out our documentation on Security Policies from the Help site. If you'd like to discuss in more detail, feel free to open a case with Okta support.

    Expand Post
    Selected as Best
This question is closed.
Loading
Self Service Password Reset - Issues