Configure workload roles

Workload roles define who can access resources in Okta Privileged Access and act as principals in security policies. These roles group multiple unique, ephemeral workloads into a single logical identity based on shared characteristics.

Before you begin

• You must have a security admin role.

• A workload connection must already exist. See Configure workload connection.

• For JWT authentication: Review Principal SSH access for automated workloads.

• For API key authentication: An API key must have been generated for the workload connection. See Manage API keys.

Create a workload role

Complete the following steps to create a workload role.

1. On the Okta Privileged Access dashboard, go to Security Administration > Workload roles.

2. Enter a Name and Description.

3. Complete the workload role requirements:

   1. Select a workload connection

   2. Optional. Click Filter with additional conditions, and then enter a Source field name, select an Operator, and enter a Value.

      Note:

      For JWT authentication: Conditions filter on JWT claims. Okta recommends inspecting your JWT using a debug script or jwt.io.

      For API key authentication: Conditions filter on API key claims. These are the key-value pairs assigned when the API key was generated. See Manage API keys for details on setting claims.

   3. Optional. Click Add a condition, and then repeat the preceding steps.

4. Optional. Click Add a requirement, and then repeat the preceding steps.

5. Click Save Workload role.

After creating the workload role, you must integrate it into the Okta Privileged Access policy engine to grant access to resources. Once the policy is published, the automated workload can execute the authentication and access sequence.

Verify workload access

After you create a workload role and add it to a security policy, verify that the workload can access the intended resources by running the sft CLI command to list servers.

1. Run the sft ls command from the workload with the appropriate authentication credentials:

   • For JWT authentication: Use the sft workload authenticate command. See CLI command for workload authentication.

   • For API key authentication: Use the sft workload authenticate command with the API key. See CLI command for workload authentication.

2. The command lists all servers that the workload role has access to based on the security policies in effect.