Okta Active Directory and Lightweight Directory Access Protocol Agent Communication Requirements

The Okta Active Directory (AD) Agent and the Okta Lightweight Directory Access Protocol (LDAP) Agent require specific network configurations to function correctly. Configure the necessary outbound ports, internal domain controller ports, and proxy settings to ensure successful connectivity between the agents and the Okta environment.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Directories
• Active Directory (AD)
• Lightweight Directory Access Protocol (LDAP)

What are the communication requirements for the Okta AD Agent?

Configure the following network ports for the Okta AD Agent to communicate successfully:

• The AD Agent initiates outbound HTTPS (TCP 443) communication to the Okta tenant.
• The AD Agent requires DNS, Kerberos, LDAP/LDAPS, Server Message Block (SMB), and Remote Procedure Call (RPC) ports, along with dynamic RPC ports TCP 49152–65535, to communicate with the Domain Controller.
• Review the Configure DMZ server ports for Active Directory integrations documentation for additional details.

What are the communication requirements for the Okta LDAP Agent?

Configure the following network ports for the Okta LDAP Agent to communicate successfully:

• The LDAP Agent initiates outbound HTTPS (TCP 443) communication to the Okta tenant.
• The LDAP Agent uses port 389 for unencrypted connections or port 636 for encrypted connections to communicate with the LDAP environment.
• Review the LDAP configuration parameters documentation for additional details.

NOTE: The LDAP ports are customizable and might differ if administrators modify them in the environment.

How are proxy and SSL decryption configurations handled?

Bypass or exclude the Okta tenant domain (*.okta.com) from SSL decryption and inspection if a proxy server or Next-Generation Firewall (NGFW) exists in the communication path from the agent to Okta over port 443.