Okta Access Gateway

https://help.okta.com/oag/en-us/content/topics/access-gateway/
Admin
Okta Access Gateway is a reverse proxy-based virtual appliance that enables protection of...
Tokens:189,359
Snippets:2,688
Trust Score:10
Update:4 months ago
Show doc for...
Tokens:
Raw
### Log Statement Example for App Setup Unresponsiveness

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/trouble-shooting-guide.htm

An example log message indicating an IOException when validating the Identity Provider host during application setup.

```log
Mar 7 17:19:43 localhost.localdomain WEB_CONSOLE IOException occurred validating IDP host :IDP login URL
```

--------------------------------

### Example az vm create command with populated parameters

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-vm-disk.htm

An example of the az vm create command with sample values for parameters.

```bash
az vm create --name "Upload-OAG-VHD" \ --resource-group "AccessGateway" --location "eastus" --image "ubuntults" \ --size "Standard_D2s_v3" --data-disk-sizes-gb 500 \ --authentication-type "password" --admin-username "okta" --admin-password "AlwaysOn@123
```

--------------------------------

### Nomination - Starting Examples

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm

Examples of log entries generated when the nomination starts on the admin node.

```log
2020-08-05T18:40:23.711-07:00 nodeB OAG ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Mgmt console Event [USER="oag-mgmt"] OAG Version - 2020.6.3, Cluster Manager Version - 2020.1.5.20200803.174755 
2020-08-05T18:40:23.711-07:00 nodeB OAG ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Mgmt console Event [USER="oag-mgmt"] Starting authorized nomination process - OAG Version - 2020.6.3, Cluster Manager Version - 2020.1.5.20200803.174755
2020-08-05T18:40:23.905-07:00 nodeB ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Send auth key to admin node [USER="oag-mgmt"] Sent nomination.authKey to admin node - existingadmin[.domain.tld]
```

--------------------------------

### START event example

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-monitor.htm

Example log entry for a service starting on an Access Gateway node.

```text
2020-03-27T21:19:24.158-05:00 example.myaccessgateway.com OAG_MONITOR MONITOR SERVICE INFO START [SERVICE="oag-admin"] Starting oag-admin.
```

--------------------------------

### Example: Upload the disk file using AzCopy

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm

An example of the `azcopy copy` command with specific values.

```bash
sudo ./azcopy copy /datadrive/temp/oag.vhd "https://md-impexp-t4pdnf22n02h.blob.core.windows.net/p15jhr4gwqhl/abcd?sv=2017-04-17&sr=b&si=b1154122-1458-4f02-a226-1554c66938c0&sig=vGnmhmKMY92r3ecQLlAEXtEHzRCFTsa5rrIxNsQqaZY%3D" -blob-type PageBlob
```

--------------------------------

### Example: Create a managed disk

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm

An example of the `az disk create` command with specific values.

```bash
az disk create -n Okta-AccessGatewayDisk --resource-group AccessGateway --location eastus --for-upload --upload-size-bytes 236246270464 --sku standard_lrs
```

--------------------------------

### System start or stop examples

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-nginx.htm

Examples of log entries for NGINX starting or stopping.

```log
2020-07-07-18:45:57 example.myaccessgateway.com systemd[1]: Stopped Access Gateway Reverse Proxy.
```

```log
2020-07-07-18:45:57 example.myaccessgateway.com systemd[1]: Started Access Gateway Reverse Proxy.
```

```log
2020-07-07-18:45:57 example.myaccessgateway.com systemd[1]: Failed to start Access Gateway Reverse Proxy.
```

--------------------------------

### System start or stop example

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-cert-chain.htm

Example log entries for when the client certificate validation service starts or stops.

```log
2021-01-20T10:54:58.075-06:00 example.myaccessgateway.com systemd Started Certificate Validation Service.
```

```log
2021-01-22T13:10:55.000-06:00 oag.okta.com CERT VERIFIER Starting [Starting(Started) application | certificate loader | service | servlet | Tomcat]
```

```log
2021-01-21T11:54:58.075-06:00 example.myaccessgateway.com systemd Stopped Certificate Validation Service.
```

--------------------------------

### Create a file system on the disk

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-prepare-temp-disk.htm

Create a pfile system on the disk using the sudo mkfs -t ext4 /dev/sdc1 command.

```bash
sudo mkfs -t ext4 /dev/sdc1
mke2ds 1.44.1
. . .
. . .
Writing superblocsl and filesystem accounting information: done
```

--------------------------------

### Sign in to Google Cloud

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-gcp-create-project-region-zone.htm

Command to authenticate with Google Cloud.

```bash
gcloud auth login
```

--------------------------------

### Nomination - initiated example

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm

Example log entry for when a nomination starts on the admin node.

```log
2020-08-04T14:28:48.376-05:00 oag.nodeC.com ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Arguments [USER="root"] Started nomination process with args: adminNode - oag.nodeA.com,nominatedNode - oag.nodeC.com, accessGatewayHostname - gw-admin.[domain.tld]
```

--------------------------------

### Example: Create a Compute Engine image

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-gcp-create-vm.htm

An example of creating a Compute Engine image, replacing placeholders with specific values.

```bash
gcloud compute images create my-image-name --source-uri gs://my-bucket-name/my-tar-file-name.tar.gz
```

--------------------------------

### Install Microsoft Azure CLI and AZCopy tools

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm

Commands to install the Microsoft Azure command-line interface and Azcopy on a virtual machine.

```bash
cd /datadrive/temp
```

```bash
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
```

```bash
sudo wget https://aka.ms/downloadazcopy-v10-linux ; sudo tar -xvf downloadazcopy-v10-linux
```

--------------------------------

### Nomination - Existing admin enters maintenance mode example

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit-adminrenom.htm

Log entry indicating the start of the Admin Node Nomination App on an existing admin node.

```log
2020-08-06T13:06:41.872-05:00 oag.nodeA.com ADMIN_CONSOLE CLUSTER MANAGER UPDATE ADMIN INFO Started Admin Node Nomination App [USER="oagha"] Started Admin Node Nomination App on admin node - existingadmin[.domain.tld]
```

--------------------------------

### Curl example requests the node's status using the default endpoint

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/monitoring-basic.htm

You make a GET request to a node's /basic_status endpoint to retrieve basic monitoring information. Include the following in your request: Host: Always monitoring.rest.service.oag.

```bash
curl -k -X GET -H "Host:monitoring.rest.service.oag" https://gw.{gateway.tld}/basic_status
```

--------------------------------

### Reboot and verify

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-prepare-temp-disk.htm

Reboot the VM, reconnect, and then verify that the new file system is mounted.

```bash
sudo shutdown -r now
ssh okta@ip address
df -h | grep sdc1
```

--------------------------------

### Initialize Google Cloud environment

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-gcp-cli.htm

Commands to initialize the Google Cloud environment after installing the CLI. These may need modification based on your specific installation.

```bash
# Linux/macOS:
./google-cloud-sdk/bin/gcloud init
# Windows:
gcloud init
```

--------------------------------

### Example: AzCopy with concurrency setting

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm

Example of using the `AZCOPY_CONCURRENCY_VALUE` environment variable to control AzCopy upload concurrency.

```bash
export AZCOPY_CONCURRENCY_VALUE=AUTOsudo nohup ; sudo ./azcopy copy /datadrive/temp/oag.vhd \ "https://md-. . . VY1SlQ79TOnwoMaVHjaqkmVlU%3D" \ --blob-type PageBlob > /tmp/azcopy.log 2>&1 &
```

--------------------------------

### Example: Grant access to a managed disk

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm

An example of the `az disk grant-access` command with specific values.

```bash
az disk grant-access -n Okta-AccessGatewayDisk --resource-group AccessGateway --access-level Write --duration-in-seconds 86400
```

--------------------------------

### Comment examples

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/advanced-oag-policy-development.htm

Examples of how to create comments in the custom configuration.

```text
#This is a comment. #This comment, preceded by a space. set $TEST "some value"; #this is also a valid comment.
```

--------------------------------

### Create a mount point

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-prepare-temp-disk.htm

Create a mount point for the new disk using the mkdir command.

```bash
sudo mkdir /datadrive
```

--------------------------------

### USER_LOGIN Examples

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm

Examples of USER_LOGIN log entries for user login attempts.

```log
2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE AUTHN LOCAL INFO USER_LOGIN [SESSION_ID="<Session ID>" SUBJECT="<User login name>" TYPE="LOCAL" RESULT="PASS" REASON="VALID_CREDENTIALS" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"] User login success: user@<domain.tld>
```

```log
2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE AUTHN LOCAL INFO USER_LOGIN [SESSION_ID="<Session ID> " SUBJECT="<User login name>" TYPE="LOCAL" RESULT="FAIL" REASON="INVALID_CREDENTIALS" REMOTE_IP="-" USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"] User login failed: user@<domain.tld>
```

```log
2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY ACCESS AUTHN SAML INFO USER_AUTHN [SESSION_ID="<Session ID> " SESSION_AUTH="<Session AUTH Information> " SUBJECT="<User login name>" TYPE="SAML_2_0" SOURCE="IDP Source URL" SOURCE_TYPE="<Identity Provider type>" SOURCE_DOMAIN="<IDP URL>" SOURCE_AUTHN_TYPE="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" APP="Sample Header App" APP_DOMAIN="<App Domain URL>" RESULT="PASS" REASON="Valid SAML Assertion" REMOTE_IP="192.168.10.20" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] User login:user@<domain.tld>
```

```log
2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY ACCESS AUTHN SAML ERROR USER_AUTHN [TYPE="SAML_2_0" TRACKER_ID="<Tracking ID>" SOURCE="https://<IDP URL>/app/template_saml_2_0/exkckwwaxvY3crKhn0h7/sso/saml" RESULT="FAIL" REASON="Invalid SAML Assertion" REMOTE_IP="192.168.10.192" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36"] Received an assertion that has expired. Check clock synchronization on IdP and SP.
```

--------------------------------

### SYSTEM_KRB5_EVENT Examples

Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm

Examples of SYSTEM_KRB5_EVENT log entries for Kerberos realm actions.

```log
2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE KRB5 - INFO SYSTEM_KRB5_EVENT [REALM="<Kerberos Realm>" REASON="CREATE" SESSION_ID="<Session ID>" SUBJECT="admin" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] Kerberos Realm: '<Kerberos Realm>' action: 'CREATE'
```

```log
2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE KRB5 - INFO SYSTEM_KRB5_EVENT [REALM="<Kerberos Realm>" REASON="UPDATE" SESSION_ID="<Session ID>" SUBJECT="user@<Domain.tld>" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] Kerberos Realm: '<Kerberos Realm>' action: 'UPDATE'
```

```log
O2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE KRB5 - INFO SYSTEM_KRB5_EVENT [REALM="<Kerberos Realm>" REASON="DELETE" SESSION_ID="<Session ID>" SUBJECT="user@<Domain.tld>" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] Kerberos Realm: '<Kerberos Realm>' action: 'DELETE'
```
Tokens:
Raw