Back to Checks
okta

Every active Okta Password Policy rejects common passwords

authenticator_password_common_password_check
Service: authenticatorSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Every active Okta Password Policy must reject passwords found in Okta's common-password dictionary (the Restrict use of common passwords setting).

Okta evaluates Password Policies by group assignment; a custom policy with the check disabled can govern users. The check emits one finding per active policy.

Prowler logoProwlerprowler-provider-okta

Risk

Without dictionary checking, users can pick passwords known to attackers from public breaches.

  • Credential stuffing succeeds with the same passwords compromised elsewhere
  • Trivial guessing stays viable for top-N lists (123456, password, …)
  • Inconsistent baselines leave users on legacy policies that allow common passwords

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_password_common_password_check

Recommendation

Configure every active Okta Password Policy so:

  • Restrict use of common passwords is enabled
  • Group assignments do not route users to legacy policies that leave the check disabled

Review each active Password Policy individually — the check evaluates them one at a time.

Remediation

Terraform

resource "okta_policy_password" "<example_resource_name>" {
  name                          = "<example_resource_name>"
  status                        = "ACTIVE"
  password_dictionary_lookup    = true  # Critical: enables the common-password dictionary check
}

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication** > **Password**.
3For every active policy, click **Edit** and enable **Restrict use of common passwords**.
4Save the policy.
5Repeat for every active Password Policy returned by the check.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
    active_password_policies,
    missing_password_policies_scope_finding,
    no_active_password_policies_finding,
    password_policy_label,
)


class authenticator_password_common_password_check(Check):
    """STIG V-273208 / OKTA-APP-002980.

    Every active Okta Password Policy must reject passwords found in the common-password dictionary.
    The check emits one finding per active policy so a weaker
    custom policy cannot hide behind a compliant default.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate all active Okta Password Policies."""
        findings = []
        org_domain = authenticator_client.provider.identity.org_domain
        requirement = "common-password dictionary checks"
        missing_scope = authenticator_client.missing_scope.get("password_policies")

        if missing_scope:
            return [
                missing_password_policies_scope_finding(
                    self.metadata(), org_domain, missing_scope, requirement
                )
            ]

        policies = active_password_policies(authenticator_client.password_policies)
        if not policies:
            return [
                no_active_password_policies_finding(
                    self.metadata(), org_domain, requirement
                )
            ]

        for policy in policies:
            report = CheckReportOkta(
                metadata=self.metadata(), resource=policy, org_domain=org_domain
            )
            if policy.common_password_check is True:
                report.status = "PASS"
                report.status_extended = (
                    f"{password_policy_label(policy)} enforces {requirement} "
                    f"(common password check enabled: {policy.common_password_check})."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"{password_policy_label(policy)} does not enforce {requirement} "
                    f"(common password check enabled: {policy.common_password_check})."
                )
            findings.append(report)
        return findings

References