Advanced Server Access

Unified identity and centralized access controls across any hybrid or multi-cloud environment.

Backed by an ephemeral client certificate architecture that replaces static SSH keys & passwords

Local server accounts and policies are automatically provisioned and deprovisioned to downstream servers from Okta as the source of truth

Designed to work out of the box with your existing SSH & RDP tools, and is easy to configure via API

• Okta as the source of truth for downstream server user & group accounts
• Central control plane for managing command-level sudo entitlements
• Automated provisioning and deprovisioning of local accounts & policies
• Streamlined Single-sign on and Multi-factor authentication for SSH & RDP workflows

• Windows 2012 and 2012r2
• Windows 2016
• Ubuntu >= 12.04
• Amazon Linux

• RedHat >= 6
• CentOS >= 6
• Debian Stable
• FreeBSD

1. Users login to a server directly from their local SSH or RDP tools - integrated with the Client Application
2. Okta authenticates the user & device, then authorizes the request against the respective role-based access controls
3. A built-in CA mints a short-lived client certificate tightly scoped to the individual request
4. The Client uses the certificate to initiate a secure SSH or RDP session with the target server
5. The login event is captured via the server agent, and sent to the audit log or 3rd party SIEM service

• Audit events captured in real-time via the Server Agent
• Audit events as structured logs for better searchability and alertability
• Captures all access decisions, login events, configuration changes, and enrollments

• Assign Okta users and groups to Advanced Server Access as a downstream application
• Apply role-based access to groups of servers within Advanced Server Access
• The Server Agent creates and manages local Linux and Windows accounts based on group membership

• Admins can create sudo entitlements in the form of executables, directories, or raw commands
• Entitlements are bound to specific groupings of servers via role-based access controls
• The Server Agent writes sudo entitlements as local drop-in files, managing its end-to-end lifecycle

• On startup, the Server Agent creates assigned user and group accounts, and writes assigned sudo entitlements
• The Server Agent periodically calls out to the backend API for any changes in user status, group membership, or sudo entitlements, and updates accordingly
• The direct relationship between Okta and downstream servers replaces the need to operate any intermediary directory services such as AD or LDAP

• Manage Okta projects
• Manage Users + groups
• Enroll servers with Okta

• Preauthorise user access
• Manage service users
• Invite users to Okta