About Okta temporary access codes
Okta supports a temporary access code (TAC) authenticator. A TAC is a short-lived code. It lets a user sign in when they cannot use their usual authenticators, for example after they lose their phone or forget their security key. After the user signs in, they can enroll new authenticators. Okta expects the administrator who creates a code to verify the identity of the user first. The administrator then gives the code to the user through a secure channel.
With Persona, the employee proves their identity with a government ID and selfie verification. Persona compares the name on the ID with the Okta profile of the employee. Only then does Persona generate the temporary access code and show it to the employee. This helps protect account recovery against social engineering, deepfakes, and account takeover. Also, your helpdesk never touches the code.
How it works
- Your helpdesk sends the employee a Persona verification link.
- Persona looks up the employee in Okta by their Okta login email.
- The employee completes a government ID and selfie verification. Persona compares the government ID with the employee’s Okta profile.
- If the verification passes, Persona generates a temporary access code in Okta and shows it on the final screen.
- The employee signs in to Okta with the code and enrolls a new authenticator.
Use a Persona organization that is only for your workforce. Keep it separate from all organizations that verify your customers. This keeps employee data and customer data apart. If you do not have a workforce organization yet, ask your Persona contact.
Okta Configuration Guide
Do the steps below to issue Okta temporary access codes with Persona. The Okta temporary access code wizard in the Persona Dashboard shows you the same steps. It also checks your configuration at each step.
1. Configure Persona Marketplace Integration for Employee Data
Context
Persona requires API access to your Okta tenant. Persona uses this access to find the employee and to generate their temporary access code.
Persona must make sure that the employee in the verification is the person who owns the Okta account to recover. To do this, Persona compares the values from the government ID of the employee with the first and last name in their Okta user profile.
Make sure that the names in Okta are the legal names of employees, not preferred names or nicknames.
Connect Okta
- Use the Okta Marketplace integration guide to create an Okta API credential. In the Persona Dashboard, add it under Integrations > Marketplace > Okta.
- Grant the credential the
okta.users.read,okta.users.manage, andokta.authenticators.readscopes. Also grant it an admin role that can view users and manage their temporary access codes, for the employees in scope. - Click Test to check the connection before you continue.
2. Turn on the temporary access code authenticator in Okta
Persona cannot generate a code until the authenticator is on for the employee.
- In the Okta Admin Console, go to Security > Authenticators. Select Add Authenticator, and add Temporary Access Code.
- Set the minimum, maximum, and default expiry lengths, the character length, and the code complexity. Persona generates codes with the default expiry length.
- Keep Allow multi-use codes off, unless you want a code to work more than one time. Persona asks for single-use codes.
- On the Enrollment tab, make sure that the authenticator is Optional for the employees who may recover this way.
- Find the authentication policy for the app that employees sign in to, for example the Okta Dashboard. In this policy, add a rule that allows Temporary Access Code as an authentication method. A temporary access code is a single knowledge factor. Thus, a rule that requires two factor types does not accept it.
- Copy the ID of the authenticator from Security > Authenticators > Temporary Access Code. It looks like
aut8j8vbvcr5b4a8l0g7. You need it in the next step.
3. Configure the Persona inquiry template
Persona gives a ready-made inquiry template for this flow. It includes the workflows that find the employee and generate the code. The wizard installs it in your workforce organization and applies your answers to it. Before you publish, check these items:
- In the two Find or Create Account steps and the Fetch Account Object step, select your account type.
- In the two Get Okta User steps and the Generate a temporary access code for a user step, select the Okta credential from Step 1.
- In the Generate a temporary access code for a user step, replace
REPLACE_WITH_OKTA_TAC_AUTHENTICATOR_IDwith the authenticator ID from Step 2. - Review the success and failure workflows. They send an email to the employee when an inquiry completes or fails. They send an email to your administrators when Persona cannot find the employee in Okta after many attempts. Change the recipients and contact addresses to your own.
- Publish the verification templates first. Then publish the workflows. Then publish the inquiry template.
4. Start account recovery for an employee
Okta does not automatically send a locked-out employee to Persona. Thus, your helpdesk starts recovery.
- In the Persona Dashboard, go to Inquiries and create an inquiry from the installed template.
- Set the Reference ID to the Okta login email of the employee, or set the account type to No Account. If you do not, the inquiry creates a second account for the employee. Then Persona cannot identify repeat attempts. If you do not set either one, the employee enters their email in the flow.
- Send the employee the inquiry link.
When the employee passes, the final screen shows their temporary access code and a copy button. The screen shows the code only one time. If the employee leaves the screen and does not copy the code, they need a new inquiry.
5. Test the integration
- Send an inquiry to a test employee and complete it.
- Make sure that the final screen shows a temporary access code. Make sure that the copy button copies the code.
- Use the code to sign in to Okta as the test employee. Enroll a new authenticator.
- Also test the failure path. Fail an inquiry on purpose. Make sure that Persona does not generate a code.
Okta allows one active temporary access code for each user. Thus, each test replaces the previous code. Test with a user whose current code you do not need.
Related resources
- Okta integration overview
- Using Persona Workflows to manage Okta users & profiles
- Okta: Configure the temporary access code authenticator
Plans Explained
Okta Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Okta Integration | Not Available | Not Available | Limited | Available |