Password Sent During User Creation to Custom SCIM Integration, Even with Password Sync Disabled
Last Updated:
Overview
This article explains the purpose of the password that Okta sends to a System for Cross-domain Identity Management (SCIM) Server when users are created.
Applies To
- Custom Cloud SCIM Integration
Cause
When a user is being provisioned via SCIM, Okta will include a placeholder password in the POST request to the SCIM server's /Users endpoint, even if the Password Sync setting is not enabled for the application.
Solution
As mentioned in Okta and SCIM Version 2.0, Okta sends the password parameter in a create user request, even if password sync is not enabled. This parameter acts as a placeholder for legacy provisioning platforms, and its value is not relevant or sensitive in nature.
If the SCIM server in question has specific password complexity requirements and is rejecting the placeholder password that Okta is sending, the complexity for the placeholder can be configured by updating the Password Policy in Okta to meet the server's complexity requirements.
