When an application acts as a profile source, imports from the application into Okta may fail to update the Okta user profiles even though the application user profile attributes are correct. This occurs because Okta performs validation for attributes on the Okta user profile, and invalid attribute values cause the entire profile update to fail. Resolve this by identifying the validation errors in the System Log and correcting the attribute values or mappings.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Profile Sourcing
• Provisioning
• Okta Integration Network (OIN)
• Universal Directory
• Lifecycle Management
• Imports

Okta performs validation for attributes on the Okta user profile. If the attribute values from the profile source fail validation, Okta fails the entire profile update for the user. Common reasons for failed profile updates include:

• Another Okta user profile already uses the Okta username (user.login).
• The mapped value for the username attribute lacks an email format or contains errors, such as a space in the email.
• The mapped value for the locale attribute lacks the correct locale format (for example, the correct format is en_US).
• The mapped value for the timezone attribute lacks the correct format (for example, the correct format is America/Denver).
• An administrator configures a length restriction on an Okta user profile attribute, and the mapped attribute is either too long or too short.
• The source passes a null value to a required Okta attribute, such as username, email, first name, or last name. Because these attributes are required, a null value fails validation and generates an error.

How are profile update validation errors identified?

Identify profile update attempts that failed due to validation errors by querying the Okta System Log and reviewing the debug data for specific error codes.

1. Navigate to the Okta System Log.
2. Enter the following log query to list all users with profile updates that failed from a configured profile source:

eventType eq "app.user_management.update_from_master_failed"

3. Expand a specific event and review the DebugData section to locate the ErrorCode, which identifies the reason for the failed profile update, and the ErrorField, which identifies the attribute that caused the error.

What are common profile update error codes?

Review the following common error codes found in the System Log to understand why a profile update failed.

• notUniqueWithinOrg: The profile update fails because the attempted username update conflicts with another Okta user profile that already uses this username. The Okta username (user.login) must be unique across all Okta user profiles in the organization.
• platform.cvd.profile.property.constraint.violation.required: The profile update fails because a required attribute on the Okta user profile is missing. The source might pass a null value into this required attribute.
• invalidLoginEmail: The profile update fails because the attribute passing to the Okta user login attribute lacks the correct email format.
• platform.cvd.profile.property.constraint.violation.maxLength: The profile update fails because the attribute passing to the Okta user profile exceeds the length restriction.
• platform.cvd.profile.property.constraint.violation.timezone: The profile update fails because the attribute mapping from the profile source to the Okta user timezone attribute lacks the correct format. Okta timezones must use the TZ timezone format.
• platform.cvd.profile.property.constraint.violation.localeFormat: The profile update fails because the attribute mapping from the profile source to the Okta user locale attribute lacks the correct format. Valid values for the locale attribute require a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US is a valid locale format.

How are profile update errors resolved?

Resolve profile update errors by reviewing the attribute values from the profile source and correcting any misconfigurations in the Okta Profile Editor, the Okta Integration Network application settings, or the application itself.

1. Review the attribute values coming from the profile source and the mappings in the Okta Profile Editor.
2. Correct any misconfigurations in the Okta organization, the Profile Editor, the Okta Integration Network (OIN) application settings, or the application itself.
   
3. Run another import after fixing the issues.
4. Monitor the System Log for additional errors and verify that the profile update completes successfully.
5. (Optional) Request a Force Sync in the To Okta section of the Provisioning tab for the profile source integration to reconcile the profile mappings from the application user profile to the Okta user profile if attribute errors appear in the Profile Editor but no error events appear in the System Log after completing an import.

Related References

• Map Okta attributes to app attributes in the Profile Editor
• How to Use the Force Sync Option
• IANA (TZDB) time zone information