Integrations use API tokens for provisioning that have an expiration date and require replacement. When the AWS IAM Identity Center access token expires, Okta fails to provision users. Resolve this by generating a new access token in the AWS IAM Identity Center and updating the API integration credentials in the Okta Admin Console.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• AWS IAM Identity Center
• Okta Integration Network (OIN)
• Provisioning

What steps generate a new access token in the AWS IAM Identity Center?

Generate a new access token and System for Cross-domain Identity Management (SCIM) endpoint in the AWS IAM Identity Center console to use for the Okta integration.

1. Navigate to the IAM Identity Center console.
2. Select Settings in the left navigation pane.
3. Locate the Automatic provisioning information box on the Settings page, and select Enable.
   NOTE: This immediately enables automatic provisioning in the IAM Identity Center and displays the necessary SCIM endpoint and access token information.
4. In the Inbound automatic provisioning window, copy the values for the SCIM endpoint and Access token.
5. Select Close.

Update the API integration Credentials in the Okta Admin Console

Update the API integration credentials in the Okta Admin Console with the newly generated SCIM endpoint and access token to restore provisioning capabilities.

1. In the Okta Admin Console, navigate to Applications > Applications.
2. Select the AWS IAM Identity Center app
3. Select the Provisioning tab.
4. Select Integration under Settings.
5. Select Edit.
6. Paste the copied SCIM endpoint value into the Base URL field.
   NOTE: Remove the trailing forward slash at the end of the URL.
7. Paste the copied Access token value into the API Token field.
8. Select Test API Credentials to verify the credentials.
9. Select Save.

Review the following image for the API integration settings.

Related References

• AWS IAM Identity Center User Guide for Okta