Okta Advanced Server Access Fails With a Certificate Does Not Contain an Authorized Principal Error

An Okta Advanced Server Access (ASA) server agent failure to update the secure shell daemon configuration file causes a server access failure. Upgrading the server tools and verifying the file permissions resolves this issue. When a user attempts to access the server through Policy Sync, the login fails and Okta generates the following error on the server:

error: Certificate does not contain an authorized principal

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Policy Sync

The Okta ASA server agent fails to update the /etc/ssh/sshd_config file with the AuthorizedPrincipalsFile directive. Policy Sync requires this directive to function. This failure occurs if the sshd_config file lacks write permissions or if the ASA server tools version is older than 1.52.

How is the server access failure resolved?

Verify the server tools version and configuration file permissions.

Verify the server tools version, update the tools, and check the configuration file permissions to resolve the error.

1. Verify that the server tools version is 1.52 or newer.
2. Install the latest version of the server tools on the target server.
3. Verify that the /etc/ssh/sshd_config file has write permissions.
4. Verify that the /etc/ssh/sshd_config file contains the following directive:

AuthorizedPrincipalsFile "%h/.asa_authorized_principals"

NOTE: The value of the directive varies if an administrator sets it through the sftd.yaml file. Review the Policy Sync documentation for more information.