Advanced Server Access architecture
End of sale announcement
Effective May 1, 2026, Okta will no longer sell or renew Advanced Server Access. Existing customers must migrate to Okta Privileged Access within one year of their next scheduled renewal date to maintain service.
Read the FAQ and learn more about Okta Privileged Access.
Advanced Server Access is a combination of the Advanced Server Access platform, clients, server agents, and gateways. Users connect to servers using the Advanced Server Access client. Servers can be placed behind gateways for compliance reasons (see Session capture) and to control pathing.
Advanced Server Access eliminates the need to maintain server credentials through the following flow when an Advanced Server Access client attempts to connect to a server:
-
Client authenticates against Okta
-
Advanced Server Access provides an ephemeral certificate to the client
-
(Optional) Client uses the certificate to authenticate against a bastion or gateway
-
Client connects to the target server
Direct Connections
In simpler configurations, the Advanced Server Access client creates SSH or RDP connections directly to servers running the Advanced Server Access server agent. The following diagram illustrates a simplified topology:
Gateway Connections
In more complex configurations, connections are first sent to an Advanced Server Access gateway before being forwarded to servers running the Advanced Server Access server agent. The following diagram illustrates a simplified topology:
