Setting up Attribute Level Mastering Skip to main content
https://support.okta.com/help/oktaarticledetailpage?childcateg=&id=ka02a0000005udtsaa&source=documentation&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fdocumentation%2fknowledge_article%2fsetting-up-attribute-level-mastering-1790609939
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Average Rating:
Setting up Attribute Level Mastering
Published: Jan 31, 2018   -   Updated: May 15, 2018

okta-doc-source

Setting up Attribute Level Mastering

Attribute-level Mastering (ALM) is a powerful feature of Okta Provisioning. Customers who previously purchased Enterprise Plus Edition also have access to ALM. For general information about provisioning, see Provisioning and Deprovisioning Overview. For details about profile mastering, see Profile Masters.

A profile master is an application (a directory service like Active Directory or an HR management software such as Workday) that can act as the "source of truth” for user identities. Currently, if more than one profile master exists on the Profile Masters page, they can be prioritized so that end users can be mastered by different systems, based on their assignments. At any given time, there can only be one profile master that masters a user's entire profile. However, ALM delivers finer grain control over how profiles are mastered by letting you specify different profile masters for individual attributes.

For example, an Okta user may have most of their profile attributes like first name, last name and department, mastered by an HR system like Workday. With attribute-level mastery, their phone number and email address attributes could be mastered by Active Directory. Furthermore, their personal email address or preferred display name could be mastered inside Okta, and managed by an Okta admin or the end user themselves.

Note: Profile mastering only applies to Okta user profiles, not app user profiles.

Setting up ALM

Using the ALM feature requires that (1) profile mastering is enabled, (2) you have chosen a profile master from the list under Profile master priority on the Profile Editor page, and (3) any desired mappings are specified through UD mapping.

The first step in setting up ALM is to enable profile mastering. Use of ALM assumes that more than one profile master is set on the Profile Masters page. In order for these profile-mastered apps to appear on the Profile Editor under Profile master priority, as shown below, profile mastering must be enabled for those apps.

NewProfile_681x218

Enabling Profile Mastering for Active Directory

  1. From the Administrative Dashboard, go to the Directory drop-down menu.
  2. From the drop-down menu, choose Directory integrations.
  3. Click the Active Directory instance.
  4. Choose the Settings tab.
  5. Scroll down to Provisioning Features > Profile Master.
  6. Check the Enable button.

Enabling Profile Mastering for Other Profile Mastering Apps

  1. From the Administrative Dashboard, go to the Applications drop-down menu.
  2. From the drop-down menu, choose Applications.
  3. Choose the app from the list of applications.
  4. From the <app> page, choose the Provisioning tab.
  5. From the left-side Settings panel, chose To Okta.
  6. Scroll down to Profile & Lifecycle Mastering and click the Allow <app> to master Okta users check box.

Establishing Profile Masters by Attribute

The second step of setting up ALM is to establish mastery by attribute. if your profile master(s) has been successfully enabled, they appear as a list under User > Profilemaster priority. When you scroll down to Attributes > Master priority (in the right-side column), the default state is Inherit from profile master, which retains the profile master set for the entire profile. To change the priority, you have the following options:

  • Inherit from profile master: Picks up the default profile master for the entire profile, as shown in the Profile master priority field.
  • Inherit from Okta: Picks up this particular attribute value from Okta. This attribute value can be edited in three ways: via the user's Profile tab, the Okta API or, if appropriate for end-user modification, by the end user.
  • Override profile master: Overrides the default profile master. Click the Add Master drop-down menu to choose another available profile master.

To change the priority:

  1. From the Directory drop-down menu, choose Profile Editor.

  2. From the Profile Editor page, select the source you wish to edit, then click Profile in the Actions column.
  3. From the left-side column (Base or Custom), choose an attribute. An example might be Last name. Click the Information icon information icon in the right-hand column.
  4. From the Master priority drop-down list, you can choose to either Inherit from profile master, Inherit from Okta, or Override profile master.

Note: The Override profile master option allows you to delete a master here if you don't want it available to a particular attribute –this does not generally disable the app as a master. Do this by clicking the X beside the app name.

Attribute Level Mastering 2_592x252

See below for an example scenario of how this might work with Workday and Active Directory as two profile masters.

Example Profile Master Set
Profile master:
Default master for the entire profile.
Workday, Active Directory
Attribute master: Alternative master for a particular attribute.

3rd attribute: mobile phone = Active Directory

All other attributes: Workday

Example Attributes
First nameWorkday
Last nameWorkday
Mobile phoneActive Directory
Work phoneWorkday

Mapping the Attribute on the Profile Mappings Page

The third, optional step of setting up ALM is to map the attribute through UD. If no mapping are set up, the attribute has a null value.

After you have chosen an attribute to change and set the Master priority to Override profile master, for example, the attribute must be mapped. To map the attribute, do the following:

  1. From the Profile Editor page, click the Profile Mappings tab.
  2. Choose the app instance of the profile master you wish to map.
  3. Click the Edit Mappings button.
  4. From the list of attributes on the left, find the attribute (such as Last name) you have chosen to change. Note: ALM only maps from a profile mastered app to Okta –it is not bidirectional.
  5. Click the Save Mappings button to save your choices.

Attribute Level Mastering 3_611x249

If you have selected an attribute that has no mapping from the primary profile master, the attribute has a null value. A value is not pulled from any other master apps in the priority list.

Allowing End-User Edit Permissions

There are some attributes that can be mastered inside Okta, then managed by an Okta admin or their end users. Although end-users cannot change their most primary attributes (such as first name, last name, or primary email), you may want to allow them to add or change attributes like personal email address or preferred display name. These attributes would appear as editable fields on their Settings > Account page.

Attribute Level Mastering 4_356x218

To allow end-user editing of certain attributes, do the following:

  1. From the Directory drop-down menu, choose Profile Editor.
  2. From the Profile Editor page, on the left-side panel under Filters, select a profile type to narrow the list of apps.
  3. Find the app source you wish to edit, then click the Profile button under the Actions column on the right-side column.
  4. Under Attributes, from the left-side column (Base or Custom), choose an attribute, then click the Information icon information icon in the right-hand column.
  5. From the User permission drop-down menu you can choose one of the following options:
  • Hide: Hides the attribute field from the end-user list.
  • Read Only: Does not allow the field to be edited.
  • Read-Write: Allows the end-user to change or add information to the attribute field.
  1. From the Master priority drop-down list, choose Inherit from Okta.
  2. Once completed, click the Save Attribute button.

Post a Comment