Okta Classic Engine release notes (Production)

Fixes

• In Preview orgs, org admins couldn't edit IdP group assignments when a super admin group was included in the group list. (OKTA-880124)

• The Edit role screen didn't always display the correct Workflow permissions. (OKTA-886964)

• Super admins saw an error when they attempted to reset a user's factors. (OKTA-890695)

• The id_token_hint parameter was exposed in the System Log. (OKTA-890738)

• When a user interacted with the Graph API in Azure Active Directory PowerShell, the activity was incorrectly logged in Office 365. (OKTA-896032)

• Users couldn't sign in to the Office 365 GCC High OIN app if it was integrated with WS-Fed. (OKTA-899506)

• On the Give access to Okta Support page, the Provide Support access for self-assigned cases section sometimes didn't display the correct cases. (OKTA-909308)

• A JavaScript issue prevented users from accessing the Glory app. (OKTA-917414)

Fixes

• When users tried to sign in from outside of their permitted network zone, they saw a Contact your administrator link on the error page even though the admin disabled the link. (OKTA-874992)

• Super admins couldn't update the operator for profile attribute conditions on a custom admin role. (OKTA-884966)

• Sometimes, Google Workspace licenses couldn't be edited. (OKTA-892397)

• Desktop Multifactor Authentication (MFA) push notifications gave the wrong name for the computer's operating system. (OKTA-902839)

• When the Unified look and feel for Okta Admin Console feature was enabled, the headings on the Downloads page were misaligned. (OKTA-904262)

• Some text strings in the Move user to realm page weren't translated. (OKTA-909317)

• When the Unified look and feel for Okta Admin Console feature was enabled, users' names didn't always render correctly. (OKTA-909497)

• Users received a 400 Bad Request error during self-service registration in preview orgs with inline hooks. (OKTA-918774)

Fixes

• On the Networks page, the Add Zone button was unexpectedly available when Admin Created was selected for some environments. (OKTA-850713)

• When a user was created and added to an app through group assignment, and the app had provisioning enabled, no application.user_membership.add event was logged. (OKTA-868825)

• When an admin performed a protected action, they weren't prompted for authentication if they had recently signed in to Okta. (OKTA-889142)

• On the End-User Dashboard, the side navigation panel didn't always reappear after a user resized their screen. (OKTA-900098)

• When the Unified look and feel for Okta Admin Console feature was enabled, the headings on the Downloads page were misaligned. (OKTA-904262)

• When the Unified look and feel for Okta Admin Console feature was enabled, admins couldn't edit a page or email template in full-screen mode in Customizations > Brands. (OKTA-905316)

• Duplicate AD/LDAP app instances could be registered for a single domain. (OKTA-911468)

• When an admin edited role notifications for the Workflows Administrator role, they saw an unresponsive dialog. (OKTA-918276)

• Users received a 400 Bad Request error during self-service registration in preview orgs with inline hooks. (OKTA-918774)

• When an Okta Classic Engine org was involved in a multi-org Okta-to-Okta authentication flow, and Okta-to-Okta claims sharing was enabled, the OktaAuth (SAML) and okta_auth (OIDC) claims weren't processed correctly. (OKTA-918969)

• Users were deactivated during imports where Super Admin privileges had been granted through group membership assignment. (OKTA-831811)

• Some admins with a custom role couldn't view client secrets for apps that they had permission to view. (OKTA-893511)

• Admins sometimes received an error when they tried to change the sign in and sign out redirect URIs for OIDC app integrations. (OKTA-901862)

• On the Admin Dashboard, the Tasks widget sometimes displayed incorrect provisioning tasks for the Okta ISV Portal App. (OKTA-902656)

• Some colors and fonts were inconsistent across the Admin Console. (OKTA-904047)

• When the Username attribute had no format restrictions applied to it, multiple identifiers could be associated with and gain access through the same account. (OKTA-910103)

• Users were prompted for multifactor authentication twice when they signed in to a spoke org in an Okta Org2Org scenario even though the Trust claims from this identity provider option was selected for the hub org. (OKTA-912172)

Fixes

• createdBy and lastUpdatedBy custom attributes couldn't be used in group rules. (OKTA-566492)

• Some issues occurred during the creation of Devices Assurance settings. (OKTA-603807)

• Custom admins who were limited to viewing only application group members received incomplete results when using the List All Users API without a search or filter. (OKTA-801592)

• In some orgs, unnecessary writebacks were made to Workday when a sync was performed from Okta. (OKTA-817160)

• Users who were excluded from a group rule were displayed incorrectly in the Admin Console. (OKTA-838039)

• The System Log displayed two usernames in the user.authentication.auth_via_social event when a user signed in to Okta with an identity provider in the same browser as a user who was already signed in. (OKTA-842179)

• Users authenticating to Microsoft Office 365 on macOS were matched to a rule with a Modern Authentication condition only when using the Edge browser. (OKTA-847605)

• Admins who were assigned the super admin role through group assignments couldn't run password hash exports or view the reports. (OKTA-851991)

• The MFA enrollment by user report displayed inaccurate figures for the security question factor. (OKTA-858427)

• Admins didn't receive the correct notifications when they had both role and admin email notifications selected. (OKTA-876846)

• When the Unified look and feel for Okta Admin Console feature was enabled, the Settings and Features pages didn't render correctly in the Safari browser. (OKTA-884821)

• Some users weren't able to sign in with Okta Mobile on iOS devices. (OKTA-892669)

• Admins couldn't create or edit third-party identity providers in orgs with Okta-to-Okta claims sharing enabled. (OKTA-893483)

Fixes

• createdBy and lastUpdatedBy custom attributes couldn't be used in group rules. (OKTA-566492)

• Workday imports sometimes failed when the number of parameters sent in a query exceeded the maximum. (OKTA-819984)

• Authentication was interrupted or prevented in legacy embedded browsers due to a DNS issue. (OKTA-845120)

• Changes to the manager attribute in Workday were only reflected in Okta after a full import. (OKTA-846352)

• The MobilePhone target (the user phone number) wasn't present in the System Log when a telephony inline hook was used. (OKTA-849440)

• The View Client Credentials permission didn't appear when the App settings for custom admin roles feature was enabled. (OKTA-851994)

• AWS account federation with SWA was incompatible with the new AWS sign in page. (OKTA-856995)

• When the Enable Sync Account Information setting was disabled for a custom domain, login.okta.com still loaded iframes. (OKTA-865098)

• In Dynamic Zones, some IPs were classified incorrectly as anonymous proxies because of a misconfiguration by a third-party provider. (OKTA-867976)

• Admins couldn't increase the global session policy maximum idle time if they set it to a longer duration than the previously saved maximum session time. (OKTA-891348)

Generally Available

Fixes

• The wrong data appeared in the debug data field of the policy.rule.update System Log event. (OKTA-846160)

• Sometimes, Google Workspace licenses couldn't be edited. (OKTA-892397)

• Admins couldn't create or edit third-party identity providers in orgs with Okta-to-Okta claims sharing enabled. (OKTA-893483)

• Admins whose role had permission conditions couldn't search for users by first or last name. (OKTA-894392)

• Some text was misaligned on the Password PolicyAdd rule page. (OKTA-897943)