provisioning connector failed" authentication to target system
Fixes provisioning connectors failing to authenticate to the target system. Use when the connector reports auth failure to the target. Not for schema or mapping errors.
TL;DR
Re-authenticate the connector: refresh its credential to the target system and test the connection. Provisioning stops the moment the stored credential dies.
Error
Provisioning connector failed: authentication to the target system failedSteps
- Open the connector configuration and run its test-connection action. Expected: the failure reproduced in isolation.
- Check what changed: expired password, rotated secret, revoked OAuth grant, or changed target URL. Expected: the cause identified.
- Update the stored credential (new password, fresh OAuth authorization, or new API credential per the target's docs) and save. Expected: the connector holds valid credentials.
- Test the connection again, then retry the failed provisioning tasks. Expected: connection succeeds and provisioning resumes.
When to use
- The connector reports authentication failure to the target
- Provisioning worked until a credential rotation
- The target admin changed something on their side
When not to use
- The connector connects but provisioning fails (a data or mapping problem)
- Okta-to-connector auth fails (an Okta-side problem)
- The target URL changed (update the endpoint, not just the credential)
Tool compatibility
Okta on-prem provisioning agent and cloud connectors. Credential types vary by target.
Variant phrasings
connector fails after the target's cert rotation
Update the trusted certificate alongside the credential.
auth fails intermittently
The target may be rate-limiting auth attempts. Slow the retry cadence.
Why it happens
Connectors store long-lived credentials that eventually expire or get revoked. Nothing monitors the credential itself, so the first sign of death is failed provisioning.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_kNRGdQVp0WcP73wvpOYyvQ