Compute the Authorization Code Hash Value for Okta System Log Analysis

For certain EventTypes in the Okta System Log, such as app.oauth2.as.token.grant.id_token and app.oauth2.as.token.grant.access_token, Okta logs a hashed Authorization Code value instead of the raw value under System > DebugContext > DebugData > AuthCode for security reasons. Compute the same hash value of the Authorization Code that Okta uses in the System Log by obtaining the raw value from the calling application and executing specific shell commands.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• OAuth 2.0
• Authorization Code Flow
• System Log

What commands compute the Authorization Code hash value?

To compute the same hash value of the Authorization Code that Okta uses in the System Log, obtain the raw value of the Authorization Code from the calling application.

Generate the hash value in a Bash environment by echoing the raw Authorization Code string and piping it through the SHA-256 checksum, hex dump, head, base64, and translation utilities.

echo -n "QwepwtUlbocEL8ei1XmKFb0pyhNH2cPbJQXNjDfm3HE" | shasum -a 256 | xxd -r -p | head -c16 | base64 | tr '+/' '-_' | tr -d '='

Generate the hash value in a PowerShell environment by converting the raw Authorization Code string to a UTF-8 byte array, computing the SHA-256 hash, and converting the first 16 bytes to a URL-safe Base64 string.

$s = "QwepwtUlbocEL8ei1XmKFb0pyhNH2cPbJQXNjDfm3HE"  
$hash = [Security.Cryptography.SHA256]::Create().ComputeHash([Text.Encoding]::UTF8.GetBytes($s))  
[Convert]::ToBase64String($hash[0..15]).Replace('+','-').Replace('/','_').TrimEnd('=')

Both commands result in a value of dEd2AEfZt0y5UezlimQqKA.

Search the System Log for the computed hash value by entering the following query into the search field.

debugContext.debugData.authCode eq "dEd2AEfZt0y5UezlimQqKA"