Okta ASA and OPA Gateway Enrollment Fails with a Resource Does Not Exist Error

An Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) gateway fails to enroll due to stale data from a previous enrollment. Removing the stale data and restarting the gateway service resolves the issue. When this occurs, the Okta gateway fails to enroll and generates the following errors in the system log:

Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.241Z DEBUG privateKeyTokenSource: Requesting JWT from OIDC source {"token_url": " https://app.scaleft.com/v1/as/agent/token"} Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR Failed to setup OAuth Private Key Token Source {"error": "oauth2: cannot fetch token: 404 Not Found\nResponse: {\n "type": "resource_does_not_exist",\n "code": 404,\n "message": "Client ID not found"\n}\n", "token_url": " https://app.scaleft.com/v1/as/agent/token" , "client_id": "0e84r4rw-aaaa-6001-cccc-23423423465dfbgdfy56"}

Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z DEBUG disconnected enabled? {"config": false, "hasLastSync": true, "hasOfflineTrusts": false}

Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR Platform configuration failed {"error": "error fetching token source: oauth2: cannot fetch token: 404 Not Found\nResponse: {\n "type": "resource_does_not_exist",\n "code": 404,\n "message": "Client ID not found"\n}\n"} Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z DEBUG transitioning to state 0

Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR Service entering failed state, shutting down

Aug 29 19:13:44 gateway sft-gatewayd[723]: 2024-08-29T19:13:44.284Z ERROR sft-gatewayd service failed, automatically retrying {"version": "1.83.1", "retry_in": "10m45.703245684s"}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)
• Gateway

The Okta gateway contains stale data from a previous enrollment under the /var/lib/sft-gatewayd directory. This occurs when an administrator deletes a gateway from the user interface or when the gateway image already contains files from a previous enrollment. When the sft-gatewayd service starts, the service uses the old data to connect to the team, which results in a failure. The /var/lib/sft-gatewayd directory requires cleaning to re-enroll the Okta gateway.

What resolves the gateway enrollment error?

Okta recommends uninstalling and reinstalling the gateway service. Review the documentation to uninstall the gateway service and install the gateway service.

Cleaning the gateway files resolves the issue.

For recently installed services, stopping the service and cleaning the files resolves the issue. Stop the gateway service, remove the data from the previous enrollment, and restart the service by following these steps.

1. Stop the gateway service (skip this step if the service is already reinstalled):

sudo systemctl stop sft-gatewayd

2. Remove the data from the previous enrollment:

sudo rm -rf /var/lib/sft-gatewayd

3. Restart the service to re-enroll the gateway using the token and create all the required files in the same location:

sudo systemctl restart sft-gatewayd

NOTE: The /etc/sft/sft-gatewayd.yaml file remains available after reinstalling the service, allowing the service to pick up the token from that location. If the token resides under /var/lib/sft-gatewayd, add the token again before executing the third step.