Okta Advanced Server Access (ASA) generates an error when attempting a Remote Desktop Protocol (RDP) connection via the Active Directory (AD) joined feature. This occurs because the attribute mapping configuration fails to relay the AD identity to Okta ASA. Resolve this issue by reviewing and correcting the AD account mapping configuration. Users experience a failure to connect via RDP and receive the following error message:

No Valid User Access Methods for this Server.

Client log messages display the following signature:

2023-09-13T13:57:42.389-0500    DEBUG    remote error returned    {"url": "https://app.scaleft.com/v1/teams/exampleteam/connection_info", "resp.RequestId": "1-65020626-610dfbe15ff56a804a3cfe08", "statusCode": 400, "err": "No valid user access methods for this server.", "err.Type": "invalid_request", "err.Code": 400, "err.Message": "No valid user access methods for this server."}
2023-09-13T13:57:42.389-0500    INFO    RecordSpan    {"t": "trace", "operation": "client.request", "start": "2023-09-13T13:57:42.132-0500", "duration": "256.7334ms", "traceID": 591782178028480058, "spanID": 4139909778910663224, "tags": {"http.method":"POST","http.request_id":"1-65020626-610dfbe15ff56a804a3cfe08","http.status_code":400,"http.url":"https://app.scaleft.com/v1/teams/exampleteam/connection_info","span.kind":"client"}}
2023-09-13T13:57:42.389-0500    ERROR    Failed to get RDPConnectionInfo from platform    {"error": "No valid user access methods for this server.", "targets": [{"id":"5410dc65-3ba1-494e-b4fa-44c72e78e4de"}]}
2023-09-13T13:57:42.389-0500    ERROR    Failed to resolve target    {"target": "5410dc65-3ba1-494e-b4fa-44c72e78e4de", "bastions": [], "error": "No valid user access methods for this server."}
2023-09-13T13:57:42.390-0500    ERROR    Failed to execute RDP from URL    {"error": "No valid user access methods for this server.", "target": "5410dc65-3ba1-494e-b4fa-44c72e78e4de", "bastions": [], "conf": {"RDP":{"Screensize":{},"Fullscreen":{},"Client":{}},"SSH":{"SavePrivatekeyPasswords":{},"PortForwardMethod":{},"InsecureForwardAgent":{},"AllowRsaSha1Keys":{}},"SSHAgent":{"Enable":{},"Keys":{}},"ServiceAuth":{"Enable":{}},"Beta":{"SSHBridgeV3":{},"DisconnectedMode":{},"UserAccessMethods":{},"PasswordLogins":{},"AccessRequests":{}},"Update":{"ReleaseChannel":{}},"Network":{"ForwardProxy":{},"TLSUseBundledCAs":{}},"ClientTrustForwarding":{"Enable":{}},"Client":{"TimeoutSeconds":{}}}}
2023-09-13T13:57:42.390-0500    ERROR    RDP URL Handler failed    {"error": "No valid user access methods for this server."}
2023-09-13T13:57:42.390-0500    DEBUG    Sending error to watcher    {"error": "Title:\"RDP URL error\"  Body:\"No valid user access methods for this server.\""}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Active Directory (AD)

The attribute mapping configuration fails to relay the Active Directory identity to Okta ASA. Okta ASA fails to receive the Active Directory identity and fails to use the correct Active Directory username in the Remote Desktop Protocol connection.

How is the Active Directory account mapping configured?

Review the Active Directory account mapping configuration and ensure the identity attributes use the correct data type to resolve the connection error.

1. Review the Okta documentation to Configure Active Directory account mapping.
2. Verify the Active Directory Identity and Active Directory Passwordless Identity attributes are configured as a string array data type instead of a string data type.
3. Modify the data type to string array if necessary.

NOTE:

• In this example, the specific issue was that the Active Directory Identity and Active Directory Passwordless Identity attributes were configured as "Data type: string" instead of "Data type: string array".
• Newer Okta ASA teams do not require manual creation of these attributes. If the issue persists, validate other aspects of the Active Directory mapping configuration. Consider using Okta ASA project-level attribute overrides if the Active Directory accounts required to log in to the Okta ASA environment differ from the Active Directory account naming scheme seen by the directory integration.