Synthèse
Okta’s Active Directory agents can be installed on member servers to provide synchronization of AD users and groups to/from Okta. This capability is thus similar to Microsoft’s Entra Connect. Unlike Microsoft, Okta recommends for the synchronization service accounts to be added to the Domain Admins group in AD, granting Okta administrators unlimited control over Active Directory. As managed service accounts are not supported by Okta, a human must set and manually rotate service account passwords
Okta’s Active Directory agents can be installed on member servers to provide synchronization of AD users and groups to/from Okta. This capability is thus similar to Microsoft’s Entra Connect. Unlike Microsoft, Okta recommends for the synchronization service accounts to be added to the Domain Admins group in AD, granting Okta administrators unlimited control over Active Directory. As managed service accounts are not supported by Okta, a human must set and manually rotate service account passwords. Figure 22.
Okta AD agent Management Utility verifying the service account’s membership of Domain Admins. The relationships between servers and agents they are hosting are represented using the Okta_HostsAgent, Okta_AgentMemberOf, and Okta_AgentPoolFor edges. Figure 23. OktaHound AD agent relationships in the graph (Okta_HostsAgent, Okta_AgentMemberOf, Okta_AgentPoolFor). The potential for privilege elevation exists in both directions: By taking over an AD user account synchronized onto a privileged account in Okta, an attacker could move from on-premises to the cloud.
Alternatively, if an Okta group is pushed into Active Directory and assigned some permissions there, an Okta user in control over the group membership could add themselves to said group and perform privilege elevation from Okta to Active Directory. OktaHound uses the following edges to represent these relationships: Okta_UserSync Okta_MembershipSync Okta_PasswordSync Okta_UserPull Okta_UserPush Okta_GroupPull Okta_GroupPush Figure 24. Modelling example of the Okta_UserSync edge. Figure 25. Modelling example of the Okta_MembershipSync edge.
As previously mentioned, well-designed Okta authentication policies can render user impersonation less feasible. Luckily for attackers, many users are susceptible to MFA fatigue.