LastPass SSO through Okta failure - pkce_missing_challenge error

GuyS
GuyS
Community Member
edited May 2023 in Business and Teams

We are currently migrating away from LastPass to 1Password, and using the Nightly version of 1Password am attempting to import my LastPass entries. We've added the redirect_uri for the desktop client (onepassword://import/login/sso), and I can confirm this is present in the "Sign-in redirect URIs" list in Okta.

When trying to import the passwords from LastPass in the 1Password desktop agent, we:
1) Click the 3 dots > Import
2) Enter the email address > Next
3) Click the button to "Sign in with SSO"

Once this button is clicked, the browser is loaded with Okta, which quickly closes. 1Password advises

"Unable to connect to LastPass"

"To continue, check your inbox for an email from LastPass to verify it's you. Alternatively, review your login info and try again"

Okta presents the error

Reason: pkce_missing_challenge

Result: FAILURE

Our Okta app for LastPass is, by recommendation, set up with:

Proof Key for Code Exchange (PKCE) :: Require PKCE as additional verification

I've found the below developer link for Okta, but it seems it's more to be updated in the app than something we can control

https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/#create-the-proof-key-for-code-exchange

Is this a known issue? Is there something on the roadmap to add the pkce as additional cerification?

1Password Version: 1Password for Windows 8.10.7 (81007033)
Extension Version: 1Password in the browser 2.10.0 20246, on STABLE
OS Version: Windows 22H2
Browser:_ Edge Version 113.0.1774.50
Referrer: forum-search:pkce_missing_challenge

Comments

  • ScottS1P
    ScottS1P

    Hello @GuyS,

    I've just checked with our team and determined that PKCE support for Okta SSO in the 1Password LastPass import tool is currently available and should be working as expected. In order for it to work, PKCE verification must be configured and enabled at both Okta and LastPass, and either side having the option disabled could result in the error you are seeing.

    Please double check your configuration, then email BusinessSupport@1Password.com if you are still having any trouble.

    Cheers,

    Scott Swezey
    Customer Support Specialist @ 1Password

    Server status | Support hub | Release notes | Passkeys
    Get a free 1Password Families membership when you use 1Password Business.

This discussion has been closed.