6 ms·

It is not ambiguous. Facilitate means help. If a user cannot trigger the reset, support engineers can (help them) do it.

chockchocschoir 5y ago
In what way would a Okta user be unable to trigger the reset while a support engineer could? If they are unable to access the Okta website where the password reset gets initiated, they are also unable to access the very same Okta website where the new password would be set. And why use the more general word of "facilitate" when they could have been specific and say "trigger reset password flow" or similar. Hence their statement is ambiguous.
- evan_ 5y ago
  It looks like there are some orgs where "forgot password" is restricted and has to go through an internal site admin- or an Okta CSE. There's not a "Reset password" link on cloudflare.okta.com for instance, just a link to contact their internal support. Regardless, "reset" can mean different things and it definitely seems like they're being cagey here by intentionally using imprecise language.
- lalopalota 5y ago
  User's laptop is lost / stolen. User notifies supervisor. Supervisor (with admin authority on the account) notifies okta support and asks that the password be reset.
  - deleted 5y ago
    [deleted]
  - gkop 5y ago
    In this scenario, it’s more secure to require the user to request their own password reset via their registered email address.
    - horsawlarway 5y ago
      There are cases where this is impossible. Ex - You have gmail gated behind okta using MFA, and the lost device is the user's MFA (ex - phone using TOTP). If the user has no session currently logged in on another device, they won't be able to create a session without their MFA device, and therefore won't be able to access their email. How likely you are to hit this depends on org settings, like gmail session time, okta session time, mfa requirements, etc. Ideally - they'd have backup codes somewhere... but most users won't (or they'll do things like store them in their email...)
      - gkop 5y ago
        As an enterprise customer, in the scenario you provided, I’d prefer if the vendor makes this my problem, by forcing me to reset the individual user’s MFA configuration, rather than try to be helpful in such a way that requires support personnel have the ability to do so. (And if I lock myself out, make it very very expensive for me to prove my identity to recover access)

chockchocschoir 5y ago

In what way would a Okta user be unable to trigger the reset while a support engineer could? If they are unable to access the Okta website where the password reset gets initiated, they are also unable to access the very same Okta website where the new password would be set. And why use the more general word of "facilitate" when they could have been specific and say "trigger reset password flow" or similar. Hence their statement is ambiguous.

evan_ 5y ago
It looks like there are some orgs where "forgot password" is restricted and has to go through an internal site admin- or an Okta CSE. There's not a "Reset password" link on cloudflare.okta.com for instance, just a link to contact their internal support. Regardless, "reset" can mean different things and it definitely seems like they're being cagey here by intentionally using imprecise language.
lalopalota 5y ago
User's laptop is lost / stolen. User notifies supervisor. Supervisor (with admin authority on the account) notifies okta support and asks that the password be reset.
- deleted 5y ago
  [deleted]
- gkop 5y ago
  In this scenario, it’s more secure to require the user to request their own password reset via their registered email address.
  - horsawlarway 5y ago
    There are cases where this is impossible. Ex - You have gmail gated behind okta using MFA, and the lost device is the user's MFA (ex - phone using TOTP). If the user has no session currently logged in on another device, they won't be able to create a session without their MFA device, and therefore won't be able to access their email. How likely you are to hit this depends on org settings, like gmail session time, okta session time, mfa requirements, etc. Ideally - they'd have backup codes somewhere... but most users won't (or they'll do things like store them in their email...)
    - gkop 5y ago
      As an enterprise customer, in the scenario you provided, I’d prefer if the vendor makes this my problem, by forcing me to reset the individual user’s MFA configuration, rather than try to be helpful in such a way that requires support personnel have the ability to do so. (And if I lock myself out, make it very very expensive for me to prove my identity to recover access)