Active Directory Attribute Country Code Fails to Sync to Okta
Last Updated:
Overview
Active Directory (AD) attributes fail to sync to the Okta countryCode attribute when the mapped attribute does not comply with the ISO-3166 standard. The Okta user.countryCode attribute requires a valid two-character, three-character, or three-digit ISO-3166 format to sync successfully. Ensure the mapped AD attribute complies with the ISO-3166 standard to resolve the synchronization failure.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Directories
- Active Directory (AD)
- Country Code Attribute
Cause
The base Okta country code attribute (user.countryCode) is a string attribute that uses the ISO-3166 country code standard. Okta uses internal logic to resolve the value when an imported attribute maps to it. The attribute accepts any ISO-3166 country code as input in a two-character, three-character, or three-digit format. Okta displays this attribute as the two-character country code. Synchronization fails if the mapped AD attribute does not match any of these accepted formats.
Solution
How is the Active Directory country code attribute synchronized to Okta?
AD provides three default attributes that map to the Okta user.countryCode attribute. Review the following table to understand the accepted formats for each AD attribute and ensure the mapped attribute complies with the ISO-3166 standard.
|
ACTIVE DIRECTORY ATTRIBUTE |
APPUSER ATTRIBUTE (OKTA REPRESENTATION OF AD ATTRIBUTE) | DESCRIPTION |
countryCode | appuser.adCountryCode |
This attribute is an integer attribute and accepts only the numeric ISO-3166 standard abbreviations. Using the default mapping for Okta TO AD, Okta sends "0," which is also technically acceptable. |
c | appuser.countryCode | This attribute is a string attribute with a three-character limit and accepts only the three-alpha ISO-3166 standard abbreviations. |
co | appuser.co | This attribute is a string attribute with a higher character limit. |
The Okta attribute user.countryCode accepts any of the listed AD attributes, but only when the mapped attribute complies with the ISO-3166 standard.
