Back to Checks
okta

Okta Smart Card IdP authenticator is configured and active

authenticator_smart_card_active
Service: authenticatorSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The Smart Card IdP authenticator (smart_card_idp) must exist in the org and be in the ACTIVE status so certificate-based authentication is available to users and apps that require it.

The check resolves the authenticator by its built-in key. Missing and inactive authenticators surface as distinct FAIL findings.

Prowler logoProwlerprowler-provider-okta

Risk

Without an active Smart Card authenticator, users cannot satisfy mandated certificate-based authentication and may be forced onto weaker fallback paths.

  • Mandated CAC/PIV use cannot be enforced
  • Compliance gaps for environments that require X.509 certificate authentication
  • Fallback to password-only sign-in for affected groups

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_smart_card_active

Recommendation

Ensure the Smart Card IdP authenticator is:

  • Present in the org (key = smart_card_idp)
  • In the ACTIVE status
  • Referenced by every Authentication Policy that requires certificate-based authentication

If certificate-based authentication is not in scope for the organization, mute the check rather than disabling the authenticator.

Remediation

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authenticators**.
3If the **Smart Card IdP** authenticator is not listed, click **Add Authenticator** and add it.
4Open the authenticator and switch its status to **ACTIVE**.
5Bind it to the Authentication Policies that require certificate-based auth.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.authenticator_helpers import (
    find_authenticator_by_key,
    missing_authenticator_resource,
    missing_authenticators_scope_finding,
)


class authenticator_smart_card_active(Check):
    """STIG V-273204 / OKTA-APP-001670.

    The check requires Okta to configure and activate the Smart Card (PIV) authenticator.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate the Smart Card IdP authenticator status."""
        org_domain = authenticator_client.provider.identity.org_domain
        missing_scope = authenticator_client.missing_scope.get("authenticators")
        if missing_scope:
            return [
                missing_authenticators_scope_finding(
                    self.metadata(),
                    org_domain,
                    "smart_card_idp",
                    "Smart Card IdP authenticator",
                    missing_scope,
                )
            ]

        authenticator = find_authenticator_by_key(
            authenticator_client.authenticators, "smart_card_idp"
        )
        resource = authenticator or missing_authenticator_resource(
            "smart_card_idp", "Smart Card IdP authenticator"
        )
        report = CheckReportOkta(
            metadata=self.metadata(), resource=resource, org_domain=org_domain
        )
        if authenticator and authenticator.status.upper() == "ACTIVE":
            report.status = "PASS"
            report.status_extended = "Smart Card IdP authenticator is ACTIVE."
        elif authenticator:
            report.status = "FAIL"
            report.status_extended = (
                f"Smart Card IdP authenticator is not active; current status is "
                f"{authenticator.status}."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                "Smart Card IdP authenticator is not active or missing."
            )
        return [report]

References