Okta Prevents Self-Service Username Changes When Read-Write Is Configured
Last Updated:
Overview
End-users cannot change their Okta username through the End-User Dashboard because Okta restricts modifications to the login base attribute. To resolve this, an Okta administrator must manually update the username on behalf of the user. When an administrator sets the login attribute to Read-Write in the Profile Editor, users still experience an inability to modify their username via self-service.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- User Profiles
- Self-Service
Cause
The login attribute functions as a restricted base attribute in Okta. Configuring the attribute with read-write permissions in the Profile Editor does not override the Okta security controls that prevent end-users from altering their primary identifier from the End-User Dashboard.
Solution
Okta Restricts the Username From Self-Service Updates
Okta ties the username directly to the primary authentication identifier. Okta security controls prevent end-users from modifying this value directly, regardless of the permissions configured in the Profile Editor.
How does an administrator update the username?
An Okta administrator must manually update the username for the affected user. Update the user profile in the Admin Console by following these steps:
- Navigate to Directory, and then select People.
- Search for and select the affected user.
- Go to the Profile tab.
- Select Edit.
- Enter the new username in the Username field.
- Select Save.
