Although applications differ, there are many apps that require manager and/or assistant information to create a complete user profile. This information can be used by apps that support hierarchical directories or approval processes. Previously, adding this data to a downstream app was a manual process. Four new Expression Language (EL) functions, getManagerUser, getAssistantUser, getManagerAppUser, and getAssistantAppUser allow you to leverage a manager or assistant relationship defined in Active Directory (AD) and pass these attributes, stored in Okta, to downstream applications.
Note: Currently, Active Directory is the only profile-master app that can be used as a source for a manager or assistant relationship. If you don’t have manager or assistant information in your AD instance, these functions cannot be employed. Also, please note that the getManagerAppUser function is currently not supported by multiple Active Directory domains and/or multiple Salesforce instances
An example usage can be seen with Google Apps. When provisioning a user, this app requires the user’s manager’s Google email address, which links the employee to the manager in Google Apps. If the manager's data is defined in AD, the org can use these new EL functions to identify the manager in Okta, identify the manager’s email address, then pass it on as part of the user’s profile.
To enable this example, you would simply add a getManagerUser(active_directory).email mapping to the Okta to Google Apps side of the Profile Mappings page. This mapping sources a user’s manager relationship from AD, and grabs the manager's email address from their Okta user profile.
The getManagerAppUser, getAssistantUser, and getAssistantAppUser functions can be used in a similar way to capture attributes from app profiles, or to obtain attributes for an Assistant. For descriptions and examples of these functions, see Manager Assistant Attribute Functions on the Okta Developer site.