Okta does not support the getManagerUser() function in environments with multiple Active Directory (AD) integrations. Further, in single-integration environments, the function does not trigger an Okta user profile update when the manager is updated. A custom expression that parses the distinguishedName format of the AD manager attribute resolves these issues.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Universal Directory

Okta does not support the getManagerUser() function in environments with more than one Active Directory (AD) domain integration. Additionally, in single-domain environments, the function does not trigger a user profile update if the AD manager changes. The Okta Expression Language developer documentation details this behavior.

How is manager email mapped using a custom expressions?

NOTE: All of the following examples use the email format of <firstName.lastName@domain.com>. If email formatting differs from this, the expression must be modified to reflect the proper format.

Use the following custom expressions based on the specific naming conventions present in the Active Directory domain to parse the distinguishedName format of the manager attribute.

• If the CN portion of the manager distinguishedName uses the format "firstName lastName" (for example, CN=John Doe, OU=...), use the following expression.

String.toLowerCase(String.substringAfter(String.substringBefore(appuser.managerDn, " "), "CN=") + "." + String.substringAfter(String.substringBefore(appuser.managerDn, ",OU"), " ")) + "@<domain.com>"

• If the CN portion uses the format "lastName, firstName" (for example, CN=Doe\, John, OU= ...), use the following expression to rearrange the first and last name and ignore the escape character.

String.toLowerCase(String.substringBefore(String.substringAfter(appuser.managerDn, "\, "), "OU=") + "." + String.substringBefore(String.substringAfter(appuser.managerDn, "CN="), "\, ")) + "@<domain.com>"

• If the CN portion includes a middle name or a middle initial, use the following expression to omit it.

String.toLowerCase(String.join(".",String.substringBefore(String.substringBefore(String.substringAfter(appuser.managerDn, "="), ",")," "),String.stringContains(String.substringAfter(String.substringBefore(String.substringAfter(appuser.managerDn, "="), ",")," ")," ") ? String.substringAfter(String.substringAfter(String.substringBefore(String.substringAfter(appuser.managerDn, "="), ",")," ")," ") : String.substringAfter(String.substringBefore(String.substringAfter(appuser.managerDn, "="), ",")," ")))  + "@<domain.com>"

Update the attribute mapping in the Okta Admin Console.

Navigate to the Profile Editor in the Okta Admin Console and apply the chosen custom expression to the manager email attribute.

1. Go to Directory > Profile Editor and select the Active Directory domain.
2. Select Mappings, which starts in the [AD domain] to Okta User view by default.
3. Enter the chosen expression for the user.managerEmail attribute.
4. Select Save Mappings.

Related References

• Okta Expression Language: Manager/assistant functions
• Okta Expression Language: String functions
• Active Directory Manager Attribute Updates Do Not Sync to Okta