Okta Error Occurs When Using API Provisioning and SAML JIT Simultaneously
Last Updated:
Overview
An Okta Org2Org System for Cross-domain Identity Management (SCIM) provisioning error occurs when using API provisioning and Security Assertion Markup Language (SAML) Just In Time (JIT) provisioning simultaneously because the identity provider (IdP) updates the user attributes and masters the profile. Resolve this issue by disconnecting the user from the profile master or disabling the attribute update setting in the IdP. The Okta dashboard displays the following error:
Operation failed because user profile is mastered under another system.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- SCIM Provisioning
- JIT Provisioning
- Org2Org
Cause
The IdP updates the user attributes on the application side. When Okta provisions the user via the SCIM API and the user accesses the application directly using SAML authentication, the IdP masters the user profile. SCIM provisioning fails because only the profile master controls the user data.
Solution
How is the profile master conflict resolved?
Disconnect the user from the profile master and retry the failed SCIM provisioning tasks.
- Disconnect the user from the profile master.
- Retry the failed SCIM provisioning tasks.
Disable the attribute update setting in the identity provider.
Navigate to the IdP settings and clear the attribute update checkbox in the JIT settings section to prevent the IdP from mastering the users during a SAML login.
- Navigate to the IdP settings.
- Clear the Update attributes for existing users checkbox.
Locate the JIT settings in the IdP configuration and verify that the Update attributes for existing users checkbox is cleared.
