When attempting to provision or assign users from Okta to HRMOS using a custom System for Cross-domain Identity Management (SCIM) application, the provisioning action fails. The following error messages appear in the Okta System Logs:
FAILURE: Multiple users found by userName. Expected 0 or 1 results but was [2 or higher]
The error states that multiple results were returned when Okta checked if a unique userName already existed in HRMOS. However, upon verification, the userName is unique and does not actually have duplicates within the target environment.
- System for Cross-domain Identity Management (SCIM) Provisioning
- HRMOS
- Okta Classic Engine
- Okta Identity Engine (OIE)
Before provisioning a user, Okta sends a standard SCIM GET request to the external application's /Users endpoint using a filter query parameter to verify if the user already exists.
GET https://core.hrmos.co/api/scim/v2/Users?filter=userName%20eq%20%22<user_email>%22&startIndex=<value>&count=100
The HRMOS CORE SCIM API does not support the filter query parameter in the GET /Users endpoint. Because HRMOS ignores the filter criteria, it treats Okta's request as a general request to "retrieve all employees." As a result, HRMOS returns the entire list of users to Okta. Okta receives this multi-user response, interprets it as multiple accounts matching that single userName, and fails the provisioning job.
Because HRMOS does not currently support the standard SCIM query parameters required for Okta's automatic provisioning verification, automated SCIM provisioning cannot be used with HRMOS at this time.
To provision or sync users between Okta and HRMOS, use an alternative manual method:
- Disable SCIM Provisioning in the HRMOS application settings within Okta to prevent ongoing sync errors.
- Export the user list from Okta
- Manually import the user list into HRMOS using its built-in user import functionality.
