<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D54z00009JbGlUCAVOkta Classic EngineDirectoriesAnswered2025-09-13T09:01:51.000Z2023-06-15T05:39:57.000Z2023-06-28T02:05:17.000Z
what account decide when username match option is "Allow short match" option?

Admin Console > Security > General > Organization Security section configured

Username match criteria on sign in : Allow short match

 

checked can login without domain

 

question is...

 

when same login id with multiple domain

example) user1@domain1.com , user1@domain2.com

 

when login with "user1", whitch account is decide? and why?

 


  • a0n5s (a0n5s)

    check the priority of the AD domain in Okta, which is the first. when it find in the first, it will not find second.

  • NiallM.34104 (Atlas Identity)

    I recommend you only enable that setting if you are confident that the element before the domain is unique. i.e. coming from a single source, or multiple sources when you guarentee it is unique. It may work without that, but you're asking for trouble.

  • tested some case

     

    checked ad agent log and okta system log

     

    directory integrated

     

    when user are

     

    when login with "user" as id, "password1" as pwd => login as user@domain1.com

    when login with "user" as id, "password2" as pwd => login as user@domain2.com

     

    when password is different at each ad,

    decide domain by entered password is currect one.

     

    when user are

     

    when login with "user" as id, "password1" as pwd => login fail

    when login with "user@domain2.com" as id, "password1" as pwd => login as user@domain1.com

    when login with "user" as id, "password2" as pwd => login fail

    when login with "user@domain2.com" as id, "password1" as pwd => login as user@domain2.com

     

    when ad password is same (more than 2 ad, i guess),

    login fail, ad priority is not work. full match username enter is only way for login

     

    i have to guided to all end-usera

    when AD password is different, enter id without domain

    when AD password is same, enter id with domain

    it was confused

     

    Expand Post
This question is closed.
Loading
what account decide when username match option is "Allow short match" option?