UBA authentication with OKTA

Hi,

We use Horde with OKTA in our build pipeline. We are using SNDBS, but we want to switch to UBA. I started investigating UBA and am now facing an issue with tokens. The configuration looks okay. The OKTA window is opened with a successful login, but no agents are assigned. I see these logs in the Visual Studio output window:

Unable to get worker: EpicGames.Horde.Compute.ComputeClientException: Bad authentication credentials. Check or refresh token. (HTTP status Unauthorized, response: )

I tested the UGS connection to the Horde, it pass without any issue, but I see some 401 errors in the log (getting Horde artifacts). Looks like I get the token, but it is an Identity token instead of an Access Token, and this token is missing claims. Is it a valid token to get data from Horde? Without any claims, it can’t get any artifacts / compute agents, etc. Are we missing anything?

Token I get after authentication with OKTA:

{

“ver”: 1,

“jti”: “[redacted]”,

“iss”: “https://console.okta.com/oauth2/default”,

“aud”: “api://default”,

“iat”: 1759263973,

“exp”: 1759267573,

“cid”: “[redacted]”,

“uid”: “[redacted]”,

“scp”: [

“openid”,

“offline_access”,

“profile”,

“email”,

“Horde”

],

“auth_time”: 1759220671,

“sub”: “[Content removed]”

}

Thank you

Marek N

Hey there,

We have some debugging tips around authentication here - I’d start there as these problems can be a bit tricky and the KB article speaks to some of the token debugging tips.

As a general question - are you seeing these issues as a USER, or as a Horde agent? Because a Horde agent using UBA should have a JIT token minted via Horde. The context matters in which you’re encountering this (and the KB article speaks to that).

Kind regards,

Julian