Okta Blank Versus Null Attribute Values in Expressions

Clearing an Okta profile attribute converts it to an empty string ("") rather than a null value, which causes comparison expressions to evaluate unexpectedly. This occurs because Okta treats a blank string as a valid value that evaluates as "less than" any populated string. Resolve this by explicitly checking that the attribute value is not an empty string and verifying the attribute state via an API call. 

• Okta Identity Engine (OIE)
• Okta Classic Engine
• API Calls
• User Profile Attributes
• Lifecycle Management

This behavior occurs because Okta distinguishes between a null value and a blank (empty string " ") value. 

• A null value indicates the attribute has never been populated.
• A blank string (" ") is stored when an attribute was previously populated but its content was later removed.
• API calls can also update non-populated attributes from null to a blank value.

In comparison expressions, a blank string (" ") is treated as a value. This "empty space" value will always evaluate as "less than" any other populated string value.

How are blank and null attribute values handled in expressions?

To create reliable comparison expressions, explicitly check that the attribute's value is not a blank string. For example, an expression should verify that the value is not " " and is greater than " ".

An API call verifies the attribute state.

Determine if a custom attribute is null or blank by making an API call and reviewing the returned profile object.

1. To determine if a custom attribute is null or blank (" "), use an API call.
2. Make the following API call, replacing <url> with the environment and <userid> with user-specific values: 

GET {{url}}/api/v1/users/{{userid}}

3. Review the API response:
   • Blank (" "): The attribute is present in the profile object with an empty string value (for example, "customAttribute": "").
   • Null: The attribute is not present in the profile object.