Understanding the Okta User Profile and Application User Profile
Last Updated:
Overview
Okta defines users in the Universal Directory using two primary profile types:
- Okta User Profile.
- Application User Profile.
Okta further divides the Okta User Profile into Group Profile types and Custom Profile types.
Both profile types contain specific base attributes, custom attributes, and formatting restrictions that dictate how Okta manages user data.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta User Profile
- Application User Profile
- Universal Directory
- Lifecycle Management
Solution
In this short video, learn about the Okta User Profile and Application User Profile.
What are the characteristics of the Okta User Profile type?
The Okta User Profile type defines the default user record used in the Universal Directory. The default user profile contains 31 attributes in accordance with the RFC System for Cross-Domain Identity Management (SCIM) Core Schema and also extends with custom attributes.
Okta allows modification or removal of only the First Name and Last Name base attributes. Mark these attributes as required or optional for Okta-sourced users. To import users with empty First Name and Last Name attributes, mark these attributes as optional in Okta to prevent import failures.
The default format for the Username attribute is an email address. Use the Format Restriction control to change the default format or replace it with a specific set of allowable characters.
Add custom user attributes to define additional user settings. When creating custom attributes, Okta restricts the use of the following reserved keywords: id, profile, status, transitioningtostatus, created, activated, statuschanged, lastlogin, lastupdated, passwordchanged, type, realm, realmId, password, credentials, _links, _embedded, class, and classloader.
How does the Application User Profile type function?
An Application User Profile lists the application attributes that Okta reads and writes to (read-only for identity providers). An application profile controls the attributes that Okta pushes to an application or imports from an application.
The Application User Profile type defines the attributes available for a user of that application in the Universal Directory. Okta maps the application user profile attributes to the user profile to determine the data sent to or imported from an application. Similar to user profiles, the application user profile has base attributes and custom attributes. The application determines the available custom attributes. Manage the application user profile type with the Apps API. Review the Application User Profile object and the Application User object for further details.
Like user profiles, application profiles have both base attributes and custom attributes. Application User Profiles only extend with attributes from a predefined list that Okta dynamically generates. Okta generates the list of attributes by querying the third-party application or directory for supported attributes. Each application controls the supported custom attributes. Okta customizes the profile only with attributes that the application supports. Okta does not permit the creation of a custom attribute for an application.
