Back to Checks
okta

Every active Okta Password Policy enforces a minimum length of 15 characters

authenticator_password_minimum_length_15
Service: authenticatorSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Every active Okta Password Policy must require at least 15 characters in the user's password.

Okta evaluates Password Policies by group assignment, so a permissive custom policy with a shorter minimum length can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.

Prowler logoProwlerprowler-provider-okta

Risk

Short password minimums weaken brute-force and credential-stuffing resistance for every user assigned to the affected policy.

  • Brute force completes in feasible time against short passwords
  • Credential stuffing succeeds with reused passwords from public breaches
  • Inconsistent baselines leave users on legacy policies with weaker assurance than the default

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_password_minimum_length_15

Recommendation

Configure every active Okta Password Policy so:

  • Minimum password length is 15 characters or more
  • Group assignments do not route users to legacy policies with shorter minimums

Review each active Password Policy individually — the check evaluates them one at a time.

Remediation

Terraform

resource "okta_policy_password" "<example_resource_name>" {
  name              = "<example_resource_name>"
  status            = "ACTIVE"
  password_min_length = 15  # Critical: STIG-aligned minimum
}

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication** > **Password**.
3For every active policy, click **Edit** and set *Minimum password length* to `15` or more.
4Save the policy.
5Repeat for every active Password Policy returned by the check.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
    active_password_policies,
    missing_password_policies_scope_finding,
    no_active_password_policies_finding,
    password_policy_label,
)


class authenticator_password_minimum_length_15(Check):
    """STIG V-273195 / OKTA-APP-000650.

    Every active Okta Password Policy must enforce a minimum password length of 15 characters.
    The check emits one finding per active policy so a weaker
    custom policy cannot hide behind a compliant default.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate all active Okta Password Policies."""
        findings = []
        org_domain = authenticator_client.provider.identity.org_domain
        requirement = "minimum password length of at least 15 characters"
        missing_scope = authenticator_client.missing_scope.get("password_policies")

        if missing_scope:
            return [
                missing_password_policies_scope_finding(
                    self.metadata(), org_domain, missing_scope, requirement
                )
            ]

        policies = active_password_policies(authenticator_client.password_policies)
        if not policies:
            return [
                no_active_password_policies_finding(
                    self.metadata(), org_domain, requirement
                )
            ]

        for policy in policies:
            report = CheckReportOkta(
                metadata=self.metadata(), resource=policy, org_domain=org_domain
            )
            if policy.min_length is not None and policy.min_length >= 15:
                report.status = "PASS"
                report.status_extended = (
                    f"{password_policy_label(policy)} enforces {requirement} "
                    f"(minimum length: {policy.min_length})."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"{password_policy_label(policy)} does not enforce {requirement} "
                    f"(minimum length: {policy.min_length})."
                )
            findings.append(report)
        return findings

References