## TL;DR
Re-authenticate the connector: refresh its credential to the target system and test the connection. Provisioning stops the moment the stored credential dies.

## Error
```text
Provisioning connector failed: authentication to the target system failed
```

## Steps
1. Open the connector configuration and run its test-connection action. Expected: the failure reproduced in isolation.
2. Check what changed: expired password, rotated secret, revoked OAuth grant, or changed target URL. Expected: the cause identified.
3. Update the stored credential (new password, fresh OAuth authorization, or new API credential per the target's docs) and save. Expected: the connector holds valid credentials.
4. Test the connection again, then retry the failed provisioning tasks. Expected: connection succeeds and provisioning resumes.

## When to use
- The connector reports authentication failure to the target
- Provisioning worked until a credential rotation
- The target admin changed something on their side

## When not to use
- The connector connects but provisioning fails (a data or mapping problem)
- Okta-to-connector auth fails (an Okta-side problem)
- The target URL changed (update the endpoint, not just the credential)

## Tool compatibility
Okta on-prem provisioning agent and cloud connectors. Credential types vary by target.

### Variant phrasings
### connector fails after the target's cert rotation
Update the trusted certificate alongside the credential.

### auth fails intermittently
The target may be rate-limiting auth attempts. Slow the retry cadence.

## Why it happens
Connectors store long-lived credentials that eventually expire or get revoked. Nothing monitors the credential itself, so the first sign of death is failed provisioning.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_kNRGdQVp0WcP73wvpOYyvQ