Provisioning uses the SCIM protocol to synchronize user account information between the Okta user store and the external applications that users use every day. The provisioning and deprovisioning actions are bidirectional, so is possible to create accounts inside an external application and import them into Okta, or create the accounts in Okta and then push them out to any integrated external application. A downstream application receives user data from Okta.
- Provisioning
- Deprovisioning
- Error
When is a provisioning error triggered?
When Okta is unable to create, link, update, or deactivate a user through the SCIM connector. Or when the API authentication fails.
The affected user reported that he can access the app using Okta Single Sign-On functionality, why not just ignore the provisioning error?
The SSO flow and the provisioning flow are completely independent of each other. SSO can be used without enabling provisioning and vice versa. If the provisioning error is not resolved, Okta will no longer be able to manage the user's application account or their application profile data. The authentication is not impacted.
Who is reporting the error?
The application server is the one that reports the error.
Is the application server reporting the error? But the error is reported in Okta!
Using the SCIM protocol, Okta can receive errors from the application server and display them in the Okta dashboard. These same errors are always visible in the application server backend logs.
What does the error mean and why was it triggered?
The error messages and causes differ on an app-to-app basis. Sometimes the error message is straightforward, like an error that says that there are insufficient permissions. Sometimes the error message is just an error code or points to a JSON error of a more complicated nature, which does not have a concise root cause.
Provisioning errors are common causes:
-
The Service account has invalid credentials or permissions, in which case the provisioning must either be re-authenticated or the credentials need to be replaced on the Provisioning > Integration page of the app in question.
-
The application is rejecting the provisioning action.
-
A misconfiguration on the SP side (a common case with custom apps that lack Okta's official documentation).
-
Misconfiguration in the application provisioning settings on Okta's side.
If the Create Users option is disabled, Okta will not be able to create new accounts on the app side. But it will also not be able to link already existing app user accounts with the Okta accounts assigned to the app. The error message that appears in this scenario is: User not found.
If the Update User Attributes is disabled, Okta will not be able to update the attribute values on the app side.
If the Deactivate Users option is disabled, Okta will not be able to deactivate or reactivate app accounts on the app side.
