Back to Checks
okta

Okta Dashboard authentication policy enforces phishing-resistant factors

application_dashboard_phishing_resistant_authentication
Service: applicationSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The Authentication Policy bound to the Okta Dashboard app must restrict possession factors to phishing-resistant authenticators. On the top active rule, Possession factor constraints are: Phishing resistant must be checked (possession.phishingResistant=REQUIRED).

Prowler logoProwlerprowler-provider-okta

Risk

Phishable possession factors leave end-user SSO sessions exposed to credential phishing and AiTM proxies.

  • Credential phishing against end users succeeds despite MFA
  • Session token theft through reverse-proxy AiTM attacks (Evilginx-class tooling)
  • Compromise of every downstream SSO app the user has access to

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks application_dashboard_phishing_resistant_authentication

Recommendation

Require phishing-resistant possession factors on the top active rule of the Okta Dashboard authentication policy.

Remediation

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication Policies**.
3Open the **Okta Dashboard** policy.
4Edit the top active rule.
5Under *Possession factor constraints are*, check **Phishing resistant**.
6Save the rule.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.application.application_client import (
    application_client,
)
from prowler.providers.okta.services.application.application_service import (
    DASHBOARD_APP_NAME,
)
from prowler.providers.okta.services.application.lib.application_helpers import (
    app_label,
    app_not_found_finding,
    missing_app_scope_finding,
    policy_missing_finding,
    rule_label,
    top_active_rule,
)

DASHBOARD_LABEL_HINT = "Okta Dashboard"


class application_dashboard_phishing_resistant_authentication(Check):
    """STIG V-273190 / OKTA-APP-000180.

    The Authentication Policy bound to the Okta Dashboard app must
    restrict possession factors to phishing-resistant authenticators on
    its top active rule
    (`possession.phishingResistant=REQUIRED`).
    """

    def execute(self) -> list[CheckReportOkta]:
        findings: list[CheckReportOkta] = []
        org_domain = application_client.provider.identity.org_domain

        for scope_key in ("built_in_apps", "access_policies"):
            missing_scope = application_client.missing_scope.get(scope_key)
            if missing_scope:
                findings.append(
                    missing_app_scope_finding(
                        self.metadata(),
                        org_domain,
                        missing_scope,
                        DASHBOARD_LABEL_HINT,
                    )
                )
                return findings

        app = application_client.built_in_apps.get(DASHBOARD_APP_NAME)
        if app is None:
            findings.append(
                app_not_found_finding(self.metadata(), org_domain, DASHBOARD_LABEL_HINT)
            )
            return findings

        if app.access_policy_id is None or app.access_policy is None:
            findings.append(policy_missing_finding(self.metadata(), org_domain, app))
            return findings

        report = CheckReportOkta(
            metadata=self.metadata(), resource=app, org_domain=org_domain
        )
        rule = top_active_rule(app)
        if rule is None:
            report.status = "FAIL"
            report.status_extended = (
                f"{app_label(app)} has no active rules on its Authentication "
                "Policy. The top rule must mark "
                "`Possession factor constraints are: Phishing resistant`."
            )
        elif rule.possession_phishing_resistant_required:
            report.status = "PASS"
            report.status_extended = (
                f"Top active {rule_label(rule)} on {app_label(app)} enforces "
                "phishing-resistant possession factors "
                "(`possession.phishingResistant=REQUIRED`)."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                f"Top active {rule_label(rule)} on {app_label(app)} does not "
                "enforce phishing-resistant possession factors. Enable "
                "`Possession factor constraints are: Phishing resistant` "
                "on the rule."
            )
        findings.append(report)
        return findings

References