Back to Checks
okta

Okta Verify authenticator is active and restricts enrollment to FIPS-compliant devices

authenticator_okta_verify_fips_compliant
Service: authenticatorSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The Okta Verify authenticator (okta_verify) must be present, in the ACTIVE status, and configured to require FIPS-compliant devices for enrollment (settings.compliance.fips == REQUIRED).

Missing, inactive, and active-but-non-FIPS authenticators surface as distinct FAIL findings so the operator can act on the specific gap.

Prowler logoProwlerprowler-provider-okta

Risk

Without FIPS-required enrollment, users can authenticate with devices whose cryptographic modules are not FIPS-validated.

  • Regulatory exposure under frameworks that mandate FIPS-validated cryptography
  • Inconsistent assurance across the user population
  • Weak baseline if the authenticator is active but the FIPS flag is OPTIONAL or unset

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_okta_verify_fips_compliant

Recommendation

Ensure the Okta Verify authenticator is:

  • Present in the org (key = okta_verify)
  • In the ACTIVE status
  • Configured so FIPS Compliance is Required (settings.compliance.fips == REQUIRED)

If the organization does not require FIPS-validated authenticators, mute the check rather than disabling the FIPS toggle on a partial population.

Remediation

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authenticators**.
3Activate the **Okta Verify** authenticator if it is not already `ACTIVE`.
4Open the authenticator's settings and set *FIPS Compliance* to **Users enrolling in Okta Verify can use FIPS compliant devices only**.
5Save the authenticator.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.authenticator_helpers import (
    find_authenticator_by_key,
    missing_authenticator_resource,
    missing_authenticators_scope_finding,
)


class authenticator_okta_verify_fips_compliant(Check):
    """STIG V-273205 / OKTA-APP-001700.

    The check requires Okta to restrict Okta Verify enrollment to FIPS-compliant devices.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate Okta Verify FIPS compliance settings."""
        org_domain = authenticator_client.provider.identity.org_domain
        missing_scope = authenticator_client.missing_scope.get("authenticators")
        if missing_scope:
            return [
                missing_authenticators_scope_finding(
                    self.metadata(),
                    org_domain,
                    "okta_verify",
                    "Okta Verify authenticator",
                    missing_scope,
                )
            ]

        authenticator = find_authenticator_by_key(
            authenticator_client.authenticators, "okta_verify"
        )
        resource = authenticator or missing_authenticator_resource(
            "okta_verify", "Okta Verify authenticator"
        )
        report = CheckReportOkta(
            metadata=self.metadata(), resource=resource, org_domain=org_domain
        )
        if not authenticator:
            report.status = "FAIL"
            report.status_extended = "Okta Verify authenticator is missing."
        elif authenticator.status.upper() != "ACTIVE":
            report.status = "FAIL"
            report.status_extended = (
                f"Okta Verify authenticator is not active; current status is "
                f"{authenticator.status}."
            )
        elif authenticator.fips.upper() == "REQUIRED":
            report.status = "PASS"
            report.status_extended = (
                "Okta Verify authenticator requires FIPS-compliant devices "
                "for enrollment."
            )
        else:
            current_fips = authenticator.fips or "unset"
            report.status = "FAIL"
            report.status_extended = (
                "Okta Verify authenticator is active but does not require "
                "FIPS-compliant devices for enrollment (current value: "
                f"{current_fips})."
            )
        return [report]

References