Vault or Retrieve Passwords for Individual Accounts in Okta Privileged Access
Last Updated:
Overview
Okta Privileged Access (OPA) does not vault passwords for individual accounts, as authentication occurs using short-lived credentials. Vaulting functionality applies exclusively to shared privileged accounts, and Okta automatically injects these vaulted credentials during sessions without exposing them to the user. When attempting to log in via a local server account and subsequently use sudo, the user must provide a password, prompting questions about retrieving vaulted credentials.
Applies To
- Okta Identity Engine (OIE)
- Okta Privileged Access (OPA)
- Vault or Retrieve Password
- Individual Accounts
Cause
If vaulting a local server account, the password is managed by Okta Privileged Access Management
, but if wanting to log in via that account and later use sudo, there is a need to provide the password (that needs to be retrieved from Okta).
Solution
How does Okta Privileged Access handle passwords for individual accounts?
Individual accounts that link to a user from Universal Directory (UD) do not possess a vaulted password. Okta pre-provisions these users or creates them Just-In-Time (JIT). Authentication occurs using a short-lived credential that Okta does not vault.
The vaulting functionality applies to specific shared privileged accounts.
The vaulting functionality on servers applies specifically to shared privileged accounts, such as service accounts and built-in accounts like Administrator or Root. The OPA Agent performs discovery for these accounts. Administrators define the accounts to onboard and control within the platform settings page. Once administrators enable this setting for a specific account, the OPA Agent immediately rotates the password and stores it in the vault. Additionally, the OPA Agent monitors for out-of-band password changes.
