Troubleshoot Common Okta Workflows SFTP Connector Errors
Last Updated:
Overview
An error occurs when attempting to set up a Secure File Transfer Protocol (SFTP) connection in Okta Workflows or when using an SFTP card in a flow. This happens due to various configuration or authentication issues with the SFTP server. Resolve these errors by identifying the specific error code in a test flow and applying the corresponding configuration correction. Review the following errors that Okta generates during connection setup.
Below are two examples of errors that can be seen when setting up the SFTP Connection. Further errors and information on getting a more detailed error message can be seen in the Cause/Resolution sections below:
SFTP server refused connection
cannot POST /app/api/config/<connectionID>/test (500)
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Workflows
- SFTP Connector
- Upload File
- Download File
- Write File
Cause
The cause varies depending on the specific error message generated during the SFTP connection setup or card execution. Configuration mismatches, invalid credentials, incorrect file paths, or unsupported encryption methods cause these connection failures.
Solution
How does an administrator obtain a detailed error code?
Identify the specific error code generated by the SFTP connection by creating a test flow with the following steps.
- Create a new test flow using an SFTP card, such as Download File.
- Select the SFTP connection that generated an error during setup.
- Test the card to view the detailed error response.
Review the following example of a detailed error response generated during a card test.
Common SFTP connection errors and resolutions:
Review the following example of where error messages appear within the Okta Workflows interface.
Error: SFTP Error: Authentication failed (username/password)
The SFTP server fails to validate the entered username and password combination. Verify the credentials used to set up the SFTP connection and test the combination in an external SFTP client.
Error: SFTP Error: Username/PublicKey combination invalid
The SFTP server fails to validate the entered username and key combination. Apply the following recommendations to resolve the issue.
-
- Verify the username and key used to set up the SFTP connection and test the combination in an external SFTP client.
- Verify that the public key exists on the server and that the entered username has permission to authenticate with the Secure Shell (SSH) key.
Error: SFTP Error: keyfile auth failed
The key used for the connection contains a passphrase or password added during the Privacy Enhanced Mail (PEM) creation. Create a new key without adding a passphrase or password.
Error: SFTP Error: Username/PublicKey combination invalid
The SFTP server fails to validate the entered username and key combination. Apply the following recommendations to resolve the issue.
-
- Verify the username and key used to set up the SFTP connection and test the combination in an external SFTP client.
- Verify that the public key exists on the server and that the entered username has permission to authenticate with the Secure Shell (SSH) key.
Error: SFTP Error: keyfile auth failed
The key used for the connection contains a passphrase or password added during the Privacy Enhanced Mail (PEM) creation. Create a new key without adding a passphrase or password.
Error: SFTP Error: Error parsing PEM: offset out of bounds
Okta fails to parse the key when using the username and key combination. Ensure the key contains no extra characters before or after the header and footer, and verify that the header and footer exist. Format the key correctly by reviewing the following example.
-----BEGIN OPENSSH PRIVATE KEY-----
<ACTUALKEYHEREINBETWEENTHEHEADERFOOTER>
-----END OPENSSH PRIVATE KEY-----Error: SFTP Error: Failed getting banner OR Host did not resolve any valid sockaddrs error.
This error occurs when the entered hostname is not an SFTP server, or the port is closed or not accepting additional SSH connections. Apply the following recommendations to resolve the issue.
-
- Verify the entered SFTP server information.
- Verify that the SFTP server has available connections and allows additional SSH connections.
- Check the firewall configuration to ensure the connection allows traffic.
- Add the required Okta Workflows IP addresses to the allowlist.
- See this linked KBA for IPs used by Workflows to be added to allows list for Workflows usage, including SFTP Connector.
Error: Network Error: Custom (kind: Uncategorized, error: \failed to lookup address information: Name does not resolve! )
Okta fails to resolve the hostname via Domain Name System (DNS). Verify that the hostname is correct when setting up the SFTP connection and ensure it is reachable externally outside of Okta Workflows.
Error: Missing Value: Missing password and/or private key
This error occurs when an SFTP connection setup includes a username but lacks a corresponding password or key. Reauthenticate the SFTP connection and ensure that either a password or a key accompanies the username.
Error: Failed to parse request message error
This error occurs when setting up an SFTP connection without entering a username. Reauthenticate the SFTP connection and ensure a username accompanies either a password or a key.
Error: SFTP Error: failure
This error occurs when using a valid connection with Download File or Read File cards, but the entered filename or path does not exist. Verify the spelling of the filename or path and ensure the file exists in that location on the SFTP server.
Error: SFTP Error: no such file
The specified file path is incorrect. Test the path by adding only a forward slash (/). After testing, locate the file on the SFTP server and create a folder for it (for example, /foldername/filename.csv).
Error: SFTP Error: Unable to exchange encryption keys
The client and server fail to agree on the session's encryption method. Ensure the SFTP server aligns with at least one method from each of the following categories.
-
- SSH Key Exchange Algorithms (KEX): diffie-hellman-group-exchange-sha256, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1
- SSH MACs: hmac-sha2-512, hmac-sha2-512-etm@openssh.com, hmac-sha2-256, hmac-sha2-256-etm@openssh.com, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96, hmac-ripemd160 (hmac-ripemd160@openssh.com)
- SSH Ciphers: aes256-gcm@openssh.com, aes128-gcm@openssh.com, aes256-ctr, aes192-ctr, aes128-ctr, aes256-cbc (rijndael-cbc@lysator.liu.se), aes192-cbc, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, arcfour, arcfour128
Error: Network Error: Custom { kind: Other, error: "failure" }
An invalid character exists in the uploaded filename. Remove any invalid characters from the filename (for example, !, @, #, $, :).
