Okta Advanced Server Access And Okta Privileged Access Server Enrolls Automatically When AutoEnroll Is Set to False

Okta automatically enrolls a new server on Amazon Web Services (AWS) or Google Cloud Platform (GCP) when the enrollment token file is present, even if the AutoEnroll setting is configured to false. Resolve this issue by creating a disable-autostart file before installing the Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) server agent and removing it when ready to enroll. When booting a new server on AWS or GCP, the server automatically enrolls despite the AutoEnroll setting being configured to false in the sftd.yaml file.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)
• Amazon Web Services (AWS)
• Google Cloud Platform (GCP)
• AutoEnroll

The issue occurs because the enrollment.token file is present on the server. This token file takes precedence over the AutoEnroll settings in the sftd.yaml file, causing the server to attempt enrollment automatically.

How is the automatic server enrollment issue resolved?

Prevent automatic enrollment during Amazon Machine Image (AMI) creation by creating a disable-autostart file before installing the server agent, configuring the settings, and adding the enrollment token.

1. Create a disable-autostart file at /etc/sftd/disable-autostart on the server.
2. Install the Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) server agent.
3. Configure the required settings in the sftd.yaml file.
4. Add the enrollment.token file if needed.

NOTE: By default, the scaleft-server-tools packages on Red Hat and Debian distributions automatically start sftd after installation. If the enrollment token exists on the server, the agent automatically enrolls, creates local users, and removes the enrollment token from the disk. If a disable-autostart file exists at the time of installation, the packages do not automatically start the agent. This functions well when building operating system images using tools like Packer.

How is the server enrolled after launching the Amazon Machine Image?

Enroll the server after launching the Amazon Machine Image (AMI) by removing the disable-autostart file and restarting the server or service.

1. Remove the /etc/sftd/disable-autostart file.
2. Reboot the server or restart the sftd service.