Okta Advanced Server Access and Privileged Access Authentication Token Expired Error

An authentication token expiration error occurs in Okta Advanced Server Access (ASA) and Okta Privileged Access (OPA) due to client token inactivity. Re-enrolling the client resolves this issue. When running the login command, the login fails and generates the following error:

Authentication Token Expired.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)

The client token expires due to inactivity.

What steps re-enroll the client in Okta Advanced Server Access?

Re-enroll the Okta Advanced Server Access client by running the enrollment command, authenticating through the browser, and confirming the un-enrollment and re-enrollment prompts.

1. Run the following command:

   sft enroll --team <team_name>

2. If a browser session opens, log in as directed and authorize the action to complete enrolling the client.
3. If a prompt indicates that the client is already enrolled, enter Yes to continue.
4. When a prompt to un-enroll the client appears, enter Yes.
5. Log in again by running the following command:

   sft login --team <team_name>

Re-enroll the Client in Okta Privileged Access Using the Dashboard

Re-enroll the Okta Privileged Access client by copying the enrollment command from the dashboard, authenticating through the browser, and confirming the un-enrollment and re-enrollment prompts.

1. Log in to the Okta Privileged Access dashboard.
2. Select Clients under Directory.
3. Copy the specified command and run it on the client.
4. If a browser session opens, log in as directed and authorize the action to complete enrolling the client.
5. If a prompt indicates that the client is already enrolled, enter Yes to continue.
6. When a prompt to un-enroll the client appears, enter Yes.