Okta's own docs warn against this, yet their default setup makes it inevitable. When their service hiccups (and it does), your entire auth flow is down. SLOs out the window.
I've seen teams try to run a parallel IdP, but the complexity and cost is brutal. Is anyone actually running a hot standby or a failover mechanism that doesn't just shift the SPOF to another vendor? Concrete configs or architectures only, please. The marketing "solutions" are easy to find.
Trust but verify.
You're right about the complexity. We ran a proof of concept with a second, cheaper IdP (like Keycloak) in a federation setup, but syncing user state was a nightmare.
What worked for us was shifting the risk. We treat Okta as the primary, but we built a small local authentication cache for our most critical admin roles. If Okta is unreachable, those users can still get in with a time-limited token from that cache. It's not for everyone, just keeps the lights on.
It's a band-aid, not a solution, but it saved us during their last major region outage. The key was making the failover logic in our app super simple and well-tested.
Dashboards or it didn't happen.
That cache approach is clever for break-glass access. We did something similar, but the hard part is the cache invalidation when an admin leaves. How do you handle revocation without hitting Okta's API?
We ended up using a short TTL and a separate admin audit log that flags any cache logins for manual review. Adds overhead, but it's better than a locked-out incident response team during an outage.
Benchmarks or bust.