Back to Checks
okta

Every active Okta Password Policy remembers at least 5 previous passwords

authenticator_password_history_5
Service: authenticatorSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Every active Okta Password Policy must keep at least the last 5 passwords in history so users cannot immediately recycle a recently-used password.

Okta evaluates Password Policies by group assignment, so a permissive custom policy that lowers the history depth can govern users even when the default policy is compliant. The check emits one finding per active policy.

Prowler logoProwlerprowler-provider-okta

Risk

A short password history lets users cycle back to compromised or trivially-guessable values shortly after a forced rotation.

  • Reuse of breached passwords within the same account
  • Defeats forced rotation by letting users return to a previous password
  • Inconsistent baselines leave users on legacy policies with shorter history than the default

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_password_history_5

Recommendation

Configure every active Okta Password Policy so:

  • Enforce password history for last is 5 passwords or more
  • Group assignments do not route users to legacy policies with shorter history

Review each active Password Policy individually — the check evaluates them one at a time.

Remediation

Terraform

resource "okta_policy_password" "<example_resource_name>" {
  name                  = "<example_resource_name>"
  status                = "ACTIVE"
  password_history_count = 5  # Critical: STIG-aligned history depth
}

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication** > **Password**.
3For every active policy, click **Edit** and set *Enforce password history for last* to `5` passwords or more.
4Save the policy.
5Repeat for every active Password Policy returned by the check.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
    active_password_policies,
    missing_password_policies_scope_finding,
    no_active_password_policies_finding,
    password_policy_label,
)


class authenticator_password_history_5(Check):
    """STIG V-273209 / OKTA-APP-003010.

    Every active Okta Password Policy must remember at least the last 5 previous passwords.
    The check emits one finding per active policy so a weaker
    custom policy cannot hide behind a compliant default.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate all active Okta Password Policies."""
        findings = []
        org_domain = authenticator_client.provider.identity.org_domain
        requirement = "password history of at least 5 previous passwords"
        missing_scope = authenticator_client.missing_scope.get("password_policies")

        if missing_scope:
            return [
                missing_password_policies_scope_finding(
                    self.metadata(), org_domain, missing_scope, requirement
                )
            ]

        policies = active_password_policies(authenticator_client.password_policies)
        if not policies:
            return [
                no_active_password_policies_finding(
                    self.metadata(), org_domain, requirement
                )
            ]

        for policy in policies:
            report = CheckReportOkta(
                metadata=self.metadata(), resource=policy, org_domain=org_domain
            )
            if policy.history_count is not None and policy.history_count >= 5:
                report.status = "PASS"
                report.status_extended = (
                    f"{password_policy_label(policy)} enforces {requirement} "
                    f"(password history count: {policy.history_count})."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"{password_policy_label(policy)} does not enforce {requirement} "
                    f"(password history count: {policy.history_count})."
                )
            findings.append(report)
        return findings

References