Okta Group Rule Condition Fails When Display Name Attribute Appears Blank

A group rule condition using user.displayName == null or user.displayName == "" to evaluate a blank display name attribute returns a false result because Okta dynamically assembles the display name using the first and last name of the user during creation. Resolve this issue by manually editing and deleting the display name attribute or avoiding the use of the display name in group rules.

Review the group rule condition and the resulting false evaluation in the Okta Admin Console.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Group Rules
• Null or Blank Attributes

Okta does not write the display name attribute directly to the database during initial user creation. Instead, Okta dynamically assembles the attribute within the JavaScript code by combining the first name and last name of the user with a space in between. Even if the attribute appears empty in the user profile within the Okta Admin Console, the attribute invariably holds the combined first and last name value until an administrator edits it.

Review the user profile displaying a blank display name attribute in the Okta Admin Console.

How does Okta evaluate unmodified display name attributes?

If the display name remains unmodified, Okta does not display the attribute in a GET request (api/v1/users/${usersId}). The Okta Admin Console user interface shows a blank value, but the attribute actually contains a value of user.firstName + " " + user.lastName.

Edit and delete the display name to use the null condition.

To successfully use the user.displayName == null or user.displayName == "" condition, an administrator must edit and delete the display name initially.

Modify and delete the display name to allow Okta to display the attribute in a GET request and equate a blank value to user.displayName == "" by following these steps.

1. Set a value for the display name attribute.
2. Save the changes.
3. Edit the profile and remove the initial value.
4. Save the changes again.

NOTE: Okta does not recommend creating group rules that use the display name attribute for these purposes, as this is intended product behavior.