Review Okta System Logs to Verify Custom Authorization Server Usage for OpenID Connect Applications
Last Updated:
Overview
The Okta API Access Management license is based on which custom OpenID Connect (OIDC) applications are assigned to a Custom Authorization Server. Query the Okta System Log to identify the applications using Custom Authorization Servers and update access policy assignments to restrict Custom Authorization Server usage to only include approved applications. Contact the Account Manager for details regarding contracts and licensing.
NOTE: Okta retains System Log entries for 90 days, requiring consultation with internal application owners for applications inactive during this period.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- API Access Management
- Custom OpenID Connect (OIDC) or OAuth 2.0 applications
Solution
How are Custom Authorization Server token grant events queried?
The queries below are designed to return token grant events for tokens issued by a Custom Authorization Server. Any tokens that were granted by the built-in Org Authorization Server will not be included in the output of these queries as they do not utilize the API Access Management license.
How to query for Machine-to-Machine token grants
eventType eq "app.oauth2.as.token.grant.access_token" and debugContext.debugData.grantType eq "client_credentials"In the events returned, find the name of the OpenID Connect application that requested this token in the actor.displayName field, the application ID in the actor.id field, the Authorization Server name in the debugContext.debugData.authorizationServerName field, and the Authorization Server ID in the debugContext.debugData.authorizationServer field.
How to query for user-based token grants
Query the Okta System Log for user-based flow tokens granted by a Custom Authorization Server by executing the following search.
(eventType eq "app.oauth2.as.authorize.implicit.access_token" OR eventType eq "app.oauth2.as.authorize.implicit.id_token" OR eventType eq "app.oauth2.as.token.grant" OR eventType eq "app.oauth2.as.token.grant.access_token" OR eventType eq "app.oauth2.as.token.grant.id_token" OR eventType eq "app.oauth2.as.token.grant.refresh_token") AND debugContext.debugData.grantType ne "client_credentials"actor.displayName field, the application ID in the actor.id field, the Authorization Server name in the debugContext.debugData.authorizationServerName field, the Authorization Server ID in the debugContext.debugData.authorizationServer field, and the user granted the token in the target.id field.How are Access Policies updated to restrict Custom Authorization Server usage?
After identifying the applications using the Custom Authorization Server, update the Access Policies to ensure only authorized applications can request tokens. For example, if a single Custom Authorization Server must only serve a specific test application, assign the policy exclusively to that application.
