Okta Classic Engine release notes (2024)

Fixes

• OKTA-626684

  The Security API menu and the Create token button didn't appear for some accounts with custom admin roles.

• OKTA-638138

  In the System Log, the operating system was displayed as Unknown mobile if a user approved an Okta Verify push notification from an iOS device.

• OKTA-642351

  Group memberships from deleted apps still appeared in system logs.

• OKTA-679051

  No event was recorded in the System Log when active AD users initiated self-service unlock.

• OKTA-686546

  The Connector Configuration form was missing the Edit button in orgs with the App settings permissions for custom admin roles feature enabled.

Okta Integration Network

App updates

• The AcquireTM app integration has an additional redirect URI.
• The CodeSignal app integration has a new logo.
• The Experience.com app integration now supports IdP-initiated flows.
• The OneRange app integration has a new description.
• The Peakon SCIM app integration has a new base URL and help text.
• The Peakon SAML app integration has a new logo, website, description, doc link, and new endpoints.
• The Qatalog app integration has a new logo.

New Okta Verified app integrations

• Arbolus (OIDC)
• Authomize Identity Security (API service)
• Bluescape (SAML)
• eFlok (SAML)
• Omni Analytics (SAML)
• ShareCal (SAML)

App integration fixes

• ADP mykplan.com (SWA) (OKTA-669875)
• Fidelity401k (SWA) (OKTA-659323)

Sign-In Widget, version 7.14.2

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Sign-In Widget Guide.

IP restrictions on tokens

Admins can specify allowlisted and blocklisted network zones for static, Single Sign-On Web System (SSWS) API tokens. This strengthens org security by letting them control where calls to Okta APIs can originate from. It also restricts attackers and malware from stealing SSWS tokens or replaying them outside of their IP range to gain unauthorized access.

Fixes

• OKTA-637955

  In some cases, custom admins were able to view pushed groups that weren't assigned to them.

• OKTA-639335

  When groups assigned to a deactivated app were removed from Okta, the groups remained assigned to the app.

• OKTA-649640

  Password rules weren't correctly translated in French.

• OKTA-653740

  Custom admins could access several Active Directory and LDAP agent-related API endpoints without having the correct admin permissions.

• OKTA-655791

  The User App Access report didn't display the Group Name, Group Source, and Group Membership columns for users that were assigned an app through an AD imported group.

• OKTA-658530

  Customized self-service account unlock email templates didn't display the UTC time zone for the {unlockAccountTokenExpirationDate} attribute.

• OKTA-664370

  Product System Log events for the access token, ID token, and user SSO grants didn't include externalSessionId.

• OKTA-665347

  No System Log event was generated when a user's password was expired using the API. When an admin used the API to expire a user's password, no System Log event was generated.

• OKTA-665377

  Some authenticator actions done using the API didn't appear in the System Log.

• OKTA-665903

  In some cases, where a group was unassigned from an app, members of that group were still provisioned to the app.

• OKTA-667063

  Affected entity wasn't included in the System Log when temporary access was granted using the Support User.

• OKTA-674218

  System Log events for access token and ID token grants didn't include user attributes.

• OKTA-679556

  Group Push of large groups from Okta sometimes failed to push all members to downstream apps.

• OKTA-679914

  After an org's ISO region codes were updated, their policies prevented users from signing in from Telangana, India.

• OKTA-684369

  Users were sometimes not unassigned from applications after being removed from groups on orgs that had application entitlement policy enabled.

• OKTA-686081

  Some users weren't imported after being unassigned from a sourcing app.

• OKTA-686801

  Some Salesforce provisioning jobs entered a buffered state and didn't run.

• OKTA-687812

  An error with expiring signatures prevented agents from updating to the newest version of the LDAP agent. The issue has been resolved in version 5.19.1.

• OKTA-687814

  An error with expiring signatures prevented agents from updating to the newest version of the Active Directory agent. The issue has been resolved in version 3.16.1.

• OKTA-688020

  In some orgs, users observed a timeout and error when authenticating with AWS Account Federation.

Okta Integration Network

App updates

• The Digitail app integration has new custom_location_attribute, department, and role SAML attributes.
• The Flow of Work Co app integration has been rebranded as GoFIGR.
• The OpsLevel app integration now has the group push, import users, and import groups functions.
• The Saltalk app integration has been rebranded as WeBox.

New Okta Verified app integrations

• ActivityInfo (OIDC)
• Bedrock Security (SAML)
• Clockwise (SCIM)
• CrunchyBridge (OIDC)
• ESKER (SAML)
• Inigo GraphQL (OIDC)
• MockFlow (SCIM)
• Netskope Admin Console (SAML)
• OCCAM Razor (OIDC)
• OPSWAT MetaDefender IT-OT Access (SAML)
• Tradespace (SAML)
• UKG HR Service Delivery (SCIM)

App integration fixes

• FaxSIPit (SWA) (OKTA-655845)
• My Eaton (SWA) (OKTA-670410)