Passing multivalued attributes from Okta to a System for Cross-domain Identity Management (SCIM) server requires creating multiple attributes in the SCIM application profile. The SCIM specifications allow passing multivalued attributes, such as multiple emails or roles, as a JavaScript Object Notation (JSON) array in user objects sent during create or update user requests.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System for Cross-domain Identity Management (SCIM) Server
• Create User
• Update User
• Multivalue Attributes
• User Attributes

How are multivalued attributes passed in a SCIM user object?

Create multiple attributes in the SCIM application profile, map the Okta attributes to the SCIM attributes, and assign a test user to verify the configuration by following these steps.

1. Navigate to Directory > Profile Editor and select the SCIM application profile.
2. Select Add Attribute to create the first attribute named Primary Role, with the External Name set to roles.^[type=='Primary'].value.
3. Select Add Attribute again to create another attribute named Additional Role, with the External Name set to roles.^[type=='additional'].value.
4. Navigate to Directory > Profile Editor and select the Profile button next to Okta to create two Okta profile attributes.
5. Select Add Attribute and add two Okta attributes, or use existing attributes.
6. Select Map Attributes and select the Okta to SCIM tab to map the two Okta attributes to the SCIM attributes created in the previous steps.
7. Select Save Mappings.
8. Navigate to Directory > People and select a user profile to test the configuration. Ensure that the two attributes contain a value.
9. Enable provisioning using the SCIM server in the SCIM application and assign the test user to the SCIM application.

How does the external name format construct the multivalued attribute?

Review the following examples to understand how Okta uses the external name format to construct the multivalued attribute.

Okta uses the external name format to construct the multivalued attribute. A basic multivalued attribute, according to the SCIM specification, contains at least two attributes per object. One attribute is type, and the second is value. The type identifies the kind of each value. For example, Developer Support is the value of type Primary.

The external name format uses brackets {} to indicate variable values:

{attributeName}.^[type=='{typeName}'].value

The {attributeName} specifies the name of the multivalued attribute being constructed. In the previous example, the attribute name is roles. Any other SCIM application attribute that starts with the same name is added to that array.

Review the following example of a multivalued email attribute:

"email" : [
   {
  "primary" : true,
  "value" : "username@example.com"
  },
  {
  "type" : work,
  "value" : "username@acme.com"
  }
]

Review the following example of the roles object received in the create user request:

roles:  [
{ type: 'additional', 'value ': 'Developer Support' },
{ type: 'Primary', value: 'KCS Writer' }
]