Advanced Server Access

Secure server access across any cloud

Okta provides a central control plane as a SaaS for controlling access to Linux and Windows servers across AWS, GCP, Azure, or on-premises, abstracting the complexities of managing IAM at scale.

• Okta as the source of truth for downstream server user & group accounts
• Central control plane for managing command-level sudo entitlements
• Automated provisioning and deprovisioning of local accounts & policies
• Streamlined Single-Sign On and Multifactor Authentication for SSH & RDP workflows

Lightweight agent approach

Okta Advanced Server Access ships with a lightweight server agent, installed through a few lines of bash or PowerShell baked directly into your infrastructure automation tools.

Zero Trust server auth

Every login is independently authenticated and authorized, and issued a short-lived tightly scoped credential to match.

1. Users login to a server directly from their local SSH or RDP tools - integrated with the Client Application
2. Okta authenticates the user & device, then authorizes the request against the respective role-based access controls
3. A built-in CA mints a short-lived client certificate tightly scoped to the individual request
4. The Client uses the certificate to initiate a secure SSH or RDP session with the target server
5. The login event is captured via the server agent, and sent to the audit log or 3rd party SIEM service

Granular audit of server access

Clear record of who accessed what server from which device and when - exposed via Dashboard or exported to your SIEM.

• Audit events captured in real-time via the Server Agent
• Audit events as structured logs for better searchability and alertability
• Captures all access decisions, login events, configuration changes, and enrollments

The only Identity-first approach to server access

Keep a unified directory of server users, groups, and policies within Okta Universal Directory, replacing the need to manage and protect shared accounts & shared credentials.

• Assign Okta users and groups to Advanced Server Access as a downstream application
• Apply role-based access to groups of servers within Advanced Server Access
• The Server Agent creates and manages local Linux and Windows accounts based on group membership

Central control plane for managing and deploying least privilege access

Okta enables command-level permissions via sudo entitlements as a function of its role-based access controls

• Admins can create sudo entitlements in the form of executables, directories, or raw commands
• Entitlements are bound to specific groupings of servers via role-based access controls
• The Server Agent writes sudo entitlements as local drop-in files, managing its end-to-end lifecycle

Automate user, group, and policy provisioning and deprovisioning at scale

Okta manages the end-to-end lifecycle of server users, groups, and policies directly from Universal Directory across infrastructure fleets of any scale.

• On startup, the Server Agent creates assigned user and group accounts, and writes assigned sudo entitlements
• The Server Agent periodically calls out to the backend API for any changes in user status, group membership, or sudo entitlements, and updates accordingly
• The direct relationship between Okta and downstream servers replaces the need to operate any intermediary directory services such as AD or LDAP