Okta Org2Org Provisioning Error Occurs When User Profile Is Sourced Under Another System
Last Updated:
Overview
Enabling both System for Cross-domain Identity Management (SCIM) provisioning and SAML Just-In-Time (JIT) provisioning concurrently in an Okta Org2Org setup causes user profile data conflicts. Resolve this issue by disabling the attribute update option in the Identity Provider (IdP) configuration, disconnecting the user from the profile source, and configuring attribute inheritance. When this conflict occurs, Okta generates the following error:
Automatic profile push of user <username> to app Okta Org2Org failed: Error while trying to push profile update for <username>: Operation failed because user profile is mastered under another system.
Review the following image for an example of the error message.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Org2Org
- System for Cross-domain Identity Management (SCIM) Provisioning
- Just-in-Time (JIT) Provisioning
Cause
Enabling both JIT provisioning with the update users option and SCIM provisioning for the Org2Org application causes this error. When enabled in the IdP settings, users sourced by the Org2Org IdP become IdP-sourced, meaning only the IdP updates their profiles. Activating SCIM provisioning for the Org2Org application triggers profile updates for assigned users. However, if these users are IdP-sourced, SCIM fails to update the profiles.
The user initially provisions via SCIM provisioning and subsequently accesses the Org2Org application using SAML authentication. At this point, the IdP sources the user profile, and only the profile source controls the user data. Any attempts by the SCIM connector to push updates for this user fail.
Solution
How is the attribute update option disabled in the Identity Provider configuration?
Disable the attribute update option in the Identity Provider configuration to prevent users from becoming IdP-sourced during SAML login and allow SCIM provisioning to update user profiles.
- In the Okta Admin Console of the hub environment, navigate to the Identity Provider configuration settings.
- Disable the Update attributes for existing users option.
Review the following image for the Identity Provider Just-In-Time provisioning settings.
Disconnect the user from the profile source to allow SCIM provisioning retries.
Disconnect users already sourced by the Identity Provider from the profile source to allow Okta to retry failed SCIM provisioning tasks.
- In the Okta Admin Console, navigate to Directory > People.
- Select the affected user.
- Select the Profile tab.
- Disconnect the user from the Identity Provider profile source.
How is attribute inheritance configured in the hub environment?
Configure all user attributes to inherit from Okta in the hub environment to ensure that the Org2Org application profile push is the sole application pushing updates to the Okta profile.
- In the Okta Admin Console of the hub environment, navigate to Directory > Profile Editor.
- Configure the user attributes to inherit from Okta rather than another profile source.
Review the following images for the Org2Org integration and provisioning settings.
