User Skipped During Active Directory Import - Error "Expected required AD attribute: sn, (Okta attribute: lastName) to not be null"

Okta skips user imports from Active Directory (AD) when the sn (lastName) attribute contains Kanji characters formatted as surrogate pairs or Ideographic Variation Selectors (IVS). To resolve this issue, revise the Kanji characters in AD to exclude surrogate pairs and IVS.

During an AD import, Okta skips specific users and generates the following message in the System Log:

Perform import user by AD agent
SKIPPED
Active Directory (AppInstance)

The detailed output includes the following message:

Skipping import of user CN=test,OU=members,DC=example,DC=local. Expected required AD attribute: sn, (Okta attribute: lastName) to not be null. Please consult with your Active Directory admin if you believe this user should be imported.

This error occurs even when the sn attribute contains a value in AD. Filter the System Log using the following query to locate these events:

eventType eq "system.agent.ad.import_user"

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• User Import
  
• Chinese, Japanese, and Korean (CJK)

Okta skips user imports when the username or attributes contain surrogate pairs or IVS. For example, Unicode classifies the extended "吉" character as a surrogate pair and the "辻" character with a single dot in the shinnyo radical as an IVS. Okta fails to process these specific Kanji character variants, resulting in a null value for the attribute.

What steps resolve the Kanji character import error?

Resolve the import error by reviewing the user attributes in Active Directory and replacing any unsupported Kanji character variants.

1. Review the Kanji characters used in the user's sn (lastName) attribute in Active Directory.
2. Revise the characters to exclude surrogate pairs and IVS.
3. Perform the Active Directory import again to verify that Okta imports the user successfully.