Okta JIT Deactivates AD User but a Full Import Enables the User
Last Updated:
Overview
This article explains an issue that could cause an Active Directory (AD) sourced Okta user to be deactivated by Just in Time (JIT) provisioning, but be reactivated by a full import. This issue can only occur if the Early Access feature, LDAP Filters for Active Directory Import, is in use.
Applies To
- Directories
- Active Directory
- Just In Time Provisioning (JIT)
- Deactivate users
Cause
The AD Provisioning settings contain an LDAP filter that is missing parentheses.
These settings can be found under Directory Integrations in Provisioning > Integration > User Filter.
A manual or scheduled import will automatically fill in the parentheses, but JIT Profile Refresh, which occurs when an Okta Admin views a user's Profile in Okta, will send a malformed LDAP query.
Example of a malformed query:
(&sAMAccountType=805306368(objectGUID=\00\70\C6\28\E8\4D\BF\40\BE\98\E6\D9\83\27\F4\55))
JIT Authentication attempts will also fail, but they will not result in the account being locked out. Both attempts will display the following error in the AD Agent logs located at C:\Program Files(x86)\Okta\Okta AD Agent\logs:
Sending action result (FAILURE) for action REAL_TIME_SYNC
Solution
Add parentheses around the LDAP filter in Okta:
(sAMAccountType=805306368)
