<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7VGZSA3Okta Classic EngineAdministrationAnswered2018-09-05T01:29:14.000Z2017-04-11T02:51:10.000Z2018-02-22T19:55:01.000Z

AnthonyG.98994 (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:20 AM
User cannot log in if their user account in Active Directory changes OU
We have restructured our Active Directory, and now any user that have changed OU in Active Directory can no longer sign in to Okta or any linked SSO sites.

I cannot seem to find anywhere to update the user details.

If I try to reimport, it says the user already exists.
  • 3 answers
  • 2.96K views

  • Parth Swadas (Customer)

    I think new OU(to which new users have been migrated) wasn't in OKTA's AD import lists so all the users should have been deactivated and when you try to reimport it might generate error based on "Import Matching rules" (2 same users with same details will cause conflict)

     

    You should now manually activate users in OKTA and resolve the matching rules conflict.
    Expand Post

  • AnthonyG.98994 (Customer)

    I'm not sure what I need to do.

    There does not seem to be any way to manually activate a user.

    The users are also already marked as Active in the Directory, so I don't think they can be activated twice.

     

    If I open their Person Account in the Directory, an error appears: An error occurred while provisioning rcpaqap.local

    Automatic provisioning of user <Username> to app Active Directory failed: Matching user not found Please fix this on the Tasks Page 

    I follow the link to the Tasks page, where there is one entry: Application assignments encountered errors

    Review and correct these errors to complete these app assignments. 

    I click the link to review and correct, and on the next screen, I select my Active Directory listing, and choose the "Retry Selected" button. It appears to work, and I then get a message: No assignments encountering errors were found for your query 

    If I click the Refresh button, the message comes back saying : 4 app assignments have errors And wants me to Select and Retry the AD sync again.

     

    Any ideas what I can do to fix this?

     

    All I can think of is editing each user in the Directory, turning them into dummy users, then trying to import again.

    Not really what I want to do, as it leaves these extra user accounts floating about.
    Expand Post

  • AnthonyG.98994 (Customer)

    Further to this, there was nothign else I could do, so I went through and deleted all of the OKTA users that were causing problems.

    Now, I am still unable to sync.

    For some reason OKTA still finds the users in their database and will not let me Import the users again.

     

    On the Import Users screen, the users now appear multiple times, and the OKTA side gives an error: "This choice creates a conflict"

    Here's an image which shows the problem:

    0EM2A000000XuCX

    Expand Post
This question is closed.
Loading
User cannot log in if their user account in Active Directory changes OU