An Okta Advanced Server Access (ASA) Secure Shell (SSH) connection fails with a timeout on port 4421 when administrators enable on-demand users and a firewall blocks connectivity on that port. Administrators resolve this issue by allowing connectivity on port 4421 or disabling the on-demand user setting in the project. When this issue occurs, the following error message appears:

rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 10.x.x.x:4421: i/o timeout"

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• On-Demand Users

When administrators enable on-demand users in a project, the ASA authentication flow uses port 4421. If a network configuration blocks connectivity on port 4421, the connection to the target server fails. The target server logs display user_on_demand_period, indicating that the administrator set the On Demand User Time to Live (TTL) to a specific time period. The following log example shows a TTL value of 3600 seconds:

<User Name> user_on_demand_period:3600

How does an administrator resolve the port 4421 timeout error?

Administrators must ensure the network allows connectivity on port 4421 according to the Okta Advanced Server Access Port requirements.

How does an administrator disable on-demand users?

Administrators disable on-demand users in the Okta Advanced Server Access admin dashboard by modifying the project settings.

1. Navigate to the Okta Advanced Server Access admin dashboard.
2. Go to Projects.
3. Edit the project containing the enrolled target server.
4. Set On Demand User TTL to Disabled.

The following image displays the On Demand User TTL setting configured to Disabled.