Active Directory (AD) fails to update the Okta locale attribute for existing users and prevents the creation of new users because the AD attribute format is incompatible with Okta's requirements. Resolve this by formatting the AD attribute correctly or mapping the value to a custom Okta attribute.

When AD fails to update an existing user, the Okta System Log displays Failure: in the Event Info and the following ErrorCode:

platform.cvd.profile.property.constraint.violation.localeFormat

When AD fails to create a new user, the Okta System Log displays the following error:

Create User Failure: Error Message: with the following validation errors: locale field failed validation with value '<AD attribute value>': For property '{0}', format of value {1} is invalid. Valid values are concatenation of the ISO 639-1 two letter language code, an underscore, and the ISO 3166-1 2 letter country code.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Directories
• Profile Editor

The format of the AD attribute is incompatible with the Okta locale requirement. The Okta locale attribute requires a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code.

The locale attribute requires a specific format.

Ensure the AD attribute uses the correct format before mapping it to the Okta locale attribute. The user's default location, for purposes of localizing items such as currency, date, time format, and numerical representations, must be specified. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is en_US by default.

What steps create and map a custom attribute?

If the AD attribute format cannot change, create a custom Okta attribute and map the AD attribute to it.

Create a custom attribute in the Okta profile by navigating to the Profile Editor and adding a new attribute.

1. Go to Directory, and then select Profile Editor.
2. Select Okta in the Filters list.
3. Select Profile for the Okta user profile.
4. Select Add Attribute.
5. Enter the required information for the custom attribute.
6. Select Save.

Map the AD attribute to the newly created custom Okta attribute using the Profile Editor mappings.

1. Go to Directory, and then select Profile Editor.
2. Select Directories in the Filters list.
3. Select Mappings for the AD instance.
4. Select the Active Directory to Okta User tab.
5. Locate the newly created custom attribute in the Okta User column.
6. Select the corresponding AD attribute from the dropdown menu in the Active Directory column.
7. Select Save Mappings.
8. Select Apply updates now to push the changes to existing users.

Related References

• Okta Developer Documentation: Create User