Skip to main content
Last updated on

Troubleshoot the Okta connector

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Okta from the Previews page. See Manage Databricks previews.

Resolve authentication, permission, rate-limit, and temporary service errors from the managed Okta connector in Lakeflow Connect.

For general troubleshooting guidance that applies to all managed ingestion pipelines, see Troubleshoot managed ingestion pipelines.

Pipeline fails to authenticate​

Cause: Okta returned an HTTP 401 response. The domain or SSWS API token in the Unity Catalog connection isn't valid, the token was revoked, or the administrator who created the token is deactivated.

Solution:

  1. Confirm that Domain contains your Okta organization domain, such as company-name.okta.com.
  2. In the Okta Admin Console, go to Security > API > Tokens.
  3. Confirm that the token is active and that its owner is an active administrator.
  4. If necessary, create a token and update the SSWS Token value in the Unity Catalog connection.

For setup details, see Configure authentication for Okta and Create an Okta connection.

Pipeline fails with a permission error​

Cause: Okta returned an HTTP 403 response because the administrator who owns the API token can't read a resource that the pipeline ingests.

Solution:

Create the API token with an administrator account that meets the prerequisites, then update the SSWS Token value in the Unity Catalog connection. Alternatively, remove the affected tables from the pipeline.

Okta API rate limit exceeded​

Cause: Okta returned an HTTP 429 response because requests exceeded an Okta API rate limit.

Solution:

The connector waits until the rate limit resets and retries automatically. If rate limiting continues:

  1. In the Okta Admin Console, go to Security > API > Tokens.
  2. Select the API token that the Unity Catalog connection uses.
  3. Under Token rate limits, click Edit.
  4. If your organization's policy permits, increase the percentage of each API rate limit allocated to the token.
  5. Reduce the number of concurrent pipelines that use the same token.

Okta API temporarily unavailable​

Cause: Okta returned an HTTP 5xx server error.

Solution:

The connector retries temporary server errors automatically. If the issue persists after the retries finish, wait, then run the pipeline again.

On this page