CLI command for workload authentication

Use the Okta Privileged Access client CLI for autonomous, non-interactive operations. Workloads authenticate and retrieve a temporary access token by running the sft workload authenticate command (aliased as sft wl auth), which is essential for automation scripts and CI/CD pipelines that can't rely on human intervention. You can authenticate using JWT-based credentials, API keys, or AWS IAM credentials, depending on your workload connection type.

Before you begin

You have DevOps admin or DevOps engineer role.
For JWT authentication: You have an identity token from your workload provider and it's set as an environment variable.
For API key authentication: A security admin has generated an API key for the workload connection and delivered it to you through a secure channel. See Generate, rotate, and revoke API keys for details on how security admins create API keys.
For AWS IAM authentication: The workload doesn't need to run in AWS, but it must have valid AWS credentials available in its environment. For example, the credentials can come from an IAM role attached to an AWS resource or from a named AWS profile. The workload connection is of type AWS IAM.

Example use of JWT workload authentication

Because sft workload authentication is non-interactive, you can export its token as an environment variable (OPA_TOKEN) for use in scripts.

Set OPA_ADDR and SFT_TEAM in an environment variable.


export OPA_ADDR=<URL>
export SFT_TEAM=<my-team>

Run the following command to configure your SSH settings for workload authentication.

sft ssh-config >> ~/.ssh/config

After completing this step, native SSH and SCP commands will automatically route through the SFT proxy without requiring the sft ssh wrapper. For example, scp <local-file> <hostname>:/remote/path.

Run the following command to get the OPA_TOKEN.

OPA_TOKEN=$(sft wl authenticate \
--team <my-team> \
--connection <workload-connection-name> \
--jwt-env <my-jwtnnnenv> \
--role-hint <workload-role-name>)

Execute the following command to test the configuration.

sft ssh myhost --command "echo hello"

Example use of API key workload authentication

For workload connections configured with API key authentication, you use the API key directly instead of a JWT. The security admin provides the API key out-of-band to the DevOps engineer.

Set OPA_ADDR and SFT_TEAM in environment variables.


export OPA_ADDR=<URL>
export SFT_TEAM=<my-team>

Set the API key as an environment variable.
```
export OPA_API_KEY_PROD=<your-api-key>
               
```
Note:
The API key is revealed only once at creation and includes the opakey_ prefix. Store it securely and treat it with the same care as a password. If the key is lost, request a new one from the security admin.
Run the following command to get the OPA_TOKEN.
```
export OPA_TOKEN=$(sft wl authenticate \
--team <my-team> \
--connection <workload-connection-name> \
--role-hint <workload-role-name>)		
```
Note:
When you use API key authentication, the --jwt-env flag isn't required. The command automatically uses the OPA_API_KEY_PROD environment variable that you set in the previous step.
Execute the following command to test the configuration.

sft ssh myhost --command "echo hello"

Example use of AWS IAM workload authentication

For workload connections of type AWS IAM, the workload authenticates with the AWS credentials that are available in its environment. The --aws flag signs an AWS STS GetCallerIdentity request with those credentials and sends it to Okta Privileged Access. You don't need a JWT or an API key.

Set OPA_ADDR and SFT_TEAM in environment variables.


export OPA_ADDR=<URL>
export SFT_TEAM=<my-team>

Run the following command to get the OPA_TOKEN.
```
export OPA_TOKEN=$(sft wl authenticate \
--team <my-team> \
--connection <workload-connection-name> \
--aws \
--role-hint <workload-role-name>)
```
Note:
When you use AWS IAM authentication, the --jwt-env flag isn't required.

To use the credentials from a named AWS profile, replace the --aws flag with --aws-profile <profile-name>. You must specify either --aws or --aws-profile to use AWS IAM authentication.
Execute the following command to test the configuration.

sft ssh myhost --command "echo hello"