Back to Checks
okta

Every active Okta Password Policy requires at least one symbol character

authenticator_password_complexity_symbol
Service: authenticatorSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Every active Okta Password Policy must require at least one symbol character in the user's password.

Okta evaluates Password Policies by group assignment, so a permissive custom policy that drops symbol complexity can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.

Prowler logoProwlerprowler-provider-okta

Risk

Without symbol complexity, the effective alphabet shrinks and passwords stay closer to natural-language phrases.

  • Brute force succeeds against a smaller character space
  • Wordlist attacks match dictionary words without symbol padding
  • Inconsistent baselines leave users on legacy policies with weaker complexity than the default

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_password_complexity_symbol

Recommendation

Configure every active Okta Password Policy so:

  • Minimum number of symbol characters is 1 or more
  • Group assignments do not route users to legacy policies that disable symbol complexity

Review each active Password Policy individually — the check evaluates them one at a time.

Remediation

Terraform

resource "okta_policy_password" "<example_resource_name>" {
  name                = "<example_resource_name>"
  status              = "ACTIVE"
  password_min_symbol = 1  # Critical: STIG-aligned complexity
}

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication** > **Password**.
3For every active policy, click **Edit** and enable **Symbol** under *Complexity*.
4Save the policy.
5Repeat for every active Password Policy returned by the check.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
    active_password_policies,
    missing_password_policies_scope_finding,
    no_active_password_policies_finding,
    password_policy_label,
)


class authenticator_password_complexity_symbol(Check):
    """STIG V-273199 / OKTA-APP-000700.

    Every active Okta Password Policy must require at least one symbol character.
    The check emits one finding per active policy so a weaker
    custom policy cannot hide behind a compliant default.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate all active Okta Password Policies."""
        findings = []
        org_domain = authenticator_client.provider.identity.org_domain
        requirement = "at least one symbol character"
        missing_scope = authenticator_client.missing_scope.get("password_policies")

        if missing_scope:
            return [
                missing_password_policies_scope_finding(
                    self.metadata(), org_domain, missing_scope, requirement
                )
            ]

        policies = active_password_policies(authenticator_client.password_policies)
        if not policies:
            return [
                no_active_password_policies_finding(
                    self.metadata(), org_domain, requirement
                )
            ]

        for policy in policies:
            report = CheckReportOkta(
                metadata=self.metadata(), resource=policy, org_domain=org_domain
            )
            if policy.min_symbol is not None and policy.min_symbol >= 1:
                report.status = "PASS"
                report.status_extended = (
                    f"{password_policy_label(policy)} enforces {requirement} "
                    f"(minimum symbol characters: {policy.min_symbol})."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"{password_policy_label(policy)} does not enforce {requirement} "
                    f"(minimum symbol characters: {policy.min_symbol})."
                )
            findings.append(report)
        return findings

References