Add logger warnings for no groups being loaded when no Okta token is set

[vibbix]

Background

During a recent migration, a small issue with how the Okta Tokens are handled caused a minor login issue.
In the docs this is mentioned:

Note: Support for okta auth with no API token is deprecated in Vault 1.4. If no token is supplied, Vault will function, but only locally configured group membership will be available. Without a token, groups will not be queried.

However, no warning is made.

Description

Adds warnings in 3 places that Okta provider is missing it's Auth Token needed to get groups:

• During config path write
• During initialization at startup
• if debug is enabled, during login flow via okta

Test script

Below is a quick test script to show this issue at play:

#!/usr/bin/env zsh
# Reproduces how Vault's okta auth backend behaves for the three api_token
# states, against a throwaway Vault dev container (created on a random port,
# removed on exit):
#   A: no api_token      -> login OK, ["default"] only (group lookup silently skipped)
#   B: invalid api_token -> login FAILS: "okta failure retrieving groups"
#   C: valid api_token   -> login OK, group-mapped policy applied
#
# Usage: okta-vault-repro.sh [A|B|C|all]   (default: all)
# Requirements: docker, vault CLI, jq.
# Config via env:
#   OKTA_ORG        (required) the <org>.okta.com subdomain
#   OKTA_USERNAME   (required)
#   OKTA_PASSWORD   (prompted silently if unset)
#   OKTA_API_TOKEN  (scenario C only) an SSWS management-API token for the org
#   OKTA_GROUP      okta group to map (default: Everyone — every user is in it)
#   VAULT_IMAGE     default hashicorp/vault:1.13.1
# No secret values are printed.
set -euo pipefail

SCENARIO="${1:-all}"
: "${OKTA_ORG:?set OKTA_ORG (the <org>.okta.com subdomain)}"
: "${OKTA_USERNAME:?set OKTA_USERNAME}"
if [[ -z "${OKTA_PASSWORD:-}" ]]; then
  read -rs "OKTA_PASSWORD?Okta password for $OKTA_USERNAME: "
  echo
fi
OKTA_GROUP="${OKTA_GROUP:-Everyone}"
VAULT_IMAGE="${VAULT_IMAGE:-hashicorp/vault:latest}"

CONTAINER="vault-okta-repro-$RANDOM"
docker run -d --name "$CONTAINER" -p 127.0.0.1::8200 \
  -e VAULT_DEV_ROOT_TOKEN_ID=root "$VAULT_IMAGE" >/dev/null
trap 'docker rm -f "$CONTAINER" >/dev/null 2>&1' EXIT
export VAULT_ADDR="http://$(docker port "$CONTAINER" 8200 | head -1)"

for _ in {1..15}; do
  vault status >/dev/null 2>&1 && break
  sleep 1
done
vault status >/dev/null || { echo "vault container did not become ready" >&2; exit 1 }
echo "throwaway vault ($VAULT_IMAGE) at $VAULT_ADDR"

reset_okta_auth() {
  VAULT_TOKEN=root vault auth disable okta >/dev/null 2>&1 || true
  VAULT_TOKEN=root vault auth enable okta >/dev/null
  VAULT_TOKEN=root vault write auth/okta/config org_name="$OKTA_ORG" >/dev/null
  echo 'path "sys/mounts" { capabilities = ["read"] }' |
    VAULT_TOKEN=root vault policy write group-lookup-proof - >/dev/null
  VAULT_TOKEN=root vault write "auth/okta/groups/$OKTA_GROUP" policies=group-lookup-proof >/dev/null
}

login_and_report() {
  local label="$1" out rc=0 errfile
  errfile=$(mktemp)
  out=$(vault login -no-store -format=json -method=okta username="$OKTA_USERNAME" password="$OKTA_PASSWORD" 2>"$errfile") || rc=$?
  if (( rc != 0 )); then
    echo "[$label] LOGIN FAILED (exit $rc):"
    sed 's/^/    /' "$errfile"
  else
    echo "[$label] login OK:"
    echo "$out" | jq '{policies: .auth.policies, warnings: .warnings, lease_duration: .auth.lease_duration}'
  fi
  rm -f "$errfile"
}

if [[ "$SCENARIO" == "A" || "$SCENARIO" == "all" ]]; then
  reset_okta_auth
  echo "== Scenario A: org configured, NO api_token =="
  login_and_report "A"
  echo
fi

if [[ "$SCENARIO" == "B" || "$SCENARIO" == "all" ]]; then
  reset_okta_auth
  VAULT_TOKEN=root vault write auth/okta/config org_name="$OKTA_ORG" api_token=00invalid-token >/dev/null
  echo "== Scenario B: INVALID api_token set =="
  login_and_report "B"
  echo
fi

if [[ "$SCENARIO" == "C" || "$SCENARIO" == "all" ]]; then
  : "${OKTA_API_TOKEN:?scenario C needs OKTA_API_TOKEN (SSWS management-API token)}"
  reset_okta_auth
  VAULT_TOKEN=root vault write auth/okta/config org_name="$OKTA_ORG" api_token="$OKTA_API_TOKEN" >/dev/null
  echo "== Scenario C: valid api_token set =="
  login_and_report "C"
fi

AI Disclosure

Claude helped write the bash test script.

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jul 13, 2026 4:08pm

[hashicorp-cla-app]

All committers have signed the CLA.