Back to Checks
okta

Okta Admin Console authentication policy enforces phishing-resistant factors

application_admin_console_phishing_resistant_authentication
Service: applicationSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The Authentication Policy bound to the Okta Admin Console app must restrict possession factors to phishing-resistant authenticators (FIDO2/WebAuthn, PIV/CAC, Okta FastPass with biometrics). On the top active rule, Possession factor constraints are: Phishing resistant must be checked (possession.phishingResistant=REQUIRED).

Prowler logoProwlerprowler-provider-okta

Risk

Phishable possession factors (SMS, voice, standard push, OTP delivered via reverse-proxy AiTM) leave the most privileged surface of the IdP exposed.

  • Credential phishing against administrators succeeds despite MFA
  • Adversary-in-the-Middle attacks capture session tokens through fake login pages
  • Account takeover of the tenant control plane

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks application_admin_console_phishing_resistant_authentication

Recommendation

Require phishing-resistant possession factors on the top active rule of the Okta Admin Console authentication policy.

Remediation

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication Policies**.
3Open the **Okta Admin Console** policy.
4Edit the top active rule.
5Under *Possession factor constraints are*, check **Phishing resistant**.
6Save the rule.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.application.application_client import (
    application_client,
)
from prowler.providers.okta.services.application.application_service import (
    ADMIN_CONSOLE_APP_NAME,
)
from prowler.providers.okta.services.application.lib.application_helpers import (
    app_label,
    app_not_found_finding,
    missing_app_scope_finding,
    policy_missing_finding,
    rule_label,
    top_active_rule,
)

ADMIN_CONSOLE_LABEL_HINT = "Okta Admin Console"


class application_admin_console_phishing_resistant_authentication(Check):
    """STIG V-273191 / OKTA-APP-000190.

    The Authentication Policy bound to the Okta Admin Console app must
    restrict possession factors to phishing-resistant authenticators.
    The underlying SDK exposes `phishingResistant` on each
    `PossessionConstraint`; at least one constraint object on the top
    rule must set `phishingResistant=REQUIRED` (constraints are OR-ed
    by Okta semantics).
    """

    def execute(self) -> list[CheckReportOkta]:
        findings: list[CheckReportOkta] = []
        org_domain = application_client.provider.identity.org_domain

        for scope_key in ("built_in_apps", "access_policies"):
            missing_scope = application_client.missing_scope.get(scope_key)
            if missing_scope:
                findings.append(
                    missing_app_scope_finding(
                        self.metadata(),
                        org_domain,
                        missing_scope,
                        ADMIN_CONSOLE_LABEL_HINT,
                    )
                )
                return findings

        app = application_client.built_in_apps.get(ADMIN_CONSOLE_APP_NAME)
        if app is None:
            findings.append(
                app_not_found_finding(
                    self.metadata(), org_domain, ADMIN_CONSOLE_LABEL_HINT
                )
            )
            return findings

        if app.access_policy_id is None or app.access_policy is None:
            findings.append(policy_missing_finding(self.metadata(), org_domain, app))
            return findings

        report = CheckReportOkta(
            metadata=self.metadata(), resource=app, org_domain=org_domain
        )
        rule = top_active_rule(app)
        if rule is None:
            report.status = "FAIL"
            report.status_extended = (
                f"{app_label(app)} has no active rules on its Authentication "
                "Policy. The top rule must mark "
                "`Possession factor constraints are: Phishing resistant`."
            )
        elif rule.possession_phishing_resistant_required:
            report.status = "PASS"
            report.status_extended = (
                f"Top active {rule_label(rule)} on {app_label(app)} enforces "
                "phishing-resistant possession factors "
                "(`possession.phishingResistant=REQUIRED`)."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                f"Top active {rule_label(rule)} on {app_label(app)} does not "
                "enforce phishing-resistant possession factors. Enable "
                "`Possession factor constraints are: Phishing resistant` "
                "on the rule."
            )
        findings.append(report)
        return findings

References