Okta Account Management Policy: verify once when you enroll the Persona IdP authenticator

Overview

You can use Persona with Okta in two ways:

• Persona ID verification (Configure Persona for the Okta Account Management Policy). Okta calls Persona from a rule in your Okta Account Management Policy (OAMP). The employee completes a Persona verification before Okta lets them make a sensitive change, for example enrolling an authenticator.
• The Persona IdP authenticator (Configure Persona as an Authentication Method in Okta). This authenticator uses OpenID Connect (OIDC). Employees enroll in it once. Then your authentication policies can require it as a factor.

If you use both, your OAMP rules can ask employees to verify twice when they enroll the Persona IdP authenticator. This article shows how to set up two rules so that employees verify once.

Why employees verify twice today

Okta treats authenticator enrollment as a sensitive change. This includes enrollment in the Persona IdP authenticator. If one OAMP rule requires Persona ID verification for every enrollment, this happens:

1. The employee clicks Set up next to the Persona IdP authenticator in Okta.
2. The OAMP rule triggers Persona ID verification. The employee completes it. This verification only allows the change. It does not enroll the authenticator.
3. The Persona IdP enrollment starts. The employee verifies with Persona again.

Okta cannot reuse the result of the first verification for the second. Employees can get stuck and repeat the first verification.

This is not an error in Persona. Each integration does what it was set up to do. The fix is in your OAMP rules. For how Okta evaluates OAMP rules, read Configure an Okta account management policy in the Okta developer documentation.

The fix: two rules above the catch-all

The Persona IdP enrollment already verifies the person. Thus, you do not need Persona ID verification in front of it.

Okta evaluates your OAMP rules from top to bottom. The first rule that matches wins. Add these two rules above your catch-all rule:

With this setup:

• Persona IdP enrollment matches rule 1. The employee verifies once, during the enrollment itself.
• Every other authenticator enrollment, for example Okta Verify or a security key, matches rule 2 and still requires Persona ID verification.
• Every other change works as it does today.

Add a custom expression to each rule

In Okta, add a custom expression to each rule.

Rule 1: Persona IdP only

accessRequest.operation == 'enroll' &&
accessRequest.authenticator.id == '<PERSONA_IDP_AUTHENTICATOR_ID>'

Rule 2: any enrollment

accessRequest.operation == 'enroll'

Rule 2 does not need to exclude the Persona IdP authenticator. Rule 1 is above it, so Okta never reaches rule 2 for Persona IdP enrollment.

Find the ID of the Persona IdP authenticator

Replace <PERSONA_IDP_AUTHENTICATOR_ID> with the ID of your Persona IdP authenticator. The Okta Admin Console does not show this ID. To find it:

If Persona is your only IdP authenticator, you can use the generic type instead: accessRequest.authenticator.key == 'external_idp'. If you add another IdP authenticator later, this condition also matches it. We recommend the ID.

Before you roll this out

• Keep the catch-all strict. Rule 3 still applies to everything that rules 1 and 2 do not match. Make sure it is strict. Do not weaken it to make the rules above work.
• Use the authenticator ID. Use the ID of the Persona IdP authenticator, which starts with aut. Get it from the URL during enrollment. Use the generic external IdP type only if Persona is your only IdP authenticator.
• Check the factor requirement. Employees need a phishing-resistant factor to enroll in the Persona IdP authenticator. Employees who do not have one do not match rule 1. They match rule 2 and verify twice.
• Validate first. A malformed expression may match no users. Test the rules with a preview or test group first. Confirm that your Persona ID verification rule accepts custom expressions. Then check that:
  • Setting up the Persona IdP authenticator asks for one Persona verification.
  • Setting up another authenticator, for example Okta Verify, still asks for Persona ID verification.
  • Your other OAMP actions behave as before.

Frequently asked questions

Do employees need to verify again after I change the rules?

No. Employees who already enrolled in the Persona IdP authenticator stay enrolled. The rules change only what Okta asks for the next time an employee makes a sensitive change.

Does this weaken protection for authenticator enrollment?

No. The Persona IdP enrollment still requires the employee to pass Persona verification, and rule 1 also requires a phishing-resistant factor. You remove only the extra Persona ID verification in front of it. Every other authenticator enrollment still requires Persona ID verification.

Can I write this as one rule?

You can require Persona ID verification for every enrollment except Persona IdP enrollment, and let Persona IdP enrollment fall through to the catch-all rule. This works only if your catch-all rule is strict. We recommend two rules, because each rule has one clear purpose and you do not depend on the catch-all rule.

Plans Explained

Okta Integration by plan

Learn more about pricing and plans.