erpio (erpio) asked a question.
Hi All,
Need some guidance. I need to understand; outside the setup of an activation email which is sent to a user that is onboarded (part of LCM) - when a user has been created, let us say in a system like Active Directory. We want the users line manager to be the one who receives the username and password.
I have experience with other IDAM systems and I am wondering if I am missing something. I am looking at two options:
1) An O365 workflow based email push but this only seems to send the Welcome email out. The password part seems to be something which is lost in translation and we are unable to get the password sent out to the manager.
2) An SMTP relay push with the username/password.
Any directions on having this setup would be really appreciated.
-Thanks
There is no way you can achieve this out of the box. by default when you create users in OKTA, OKTA send the activation Email to their primary Email address. however you can stop sending the activation Email while creating users. but in that case you need to set a temporary password for each user & they will be asked to change it during first login. However again your OKTA admin will know their temporary passwords.
Thanks for your feedback Sandeep. So like other IAM solutions; if I want to configure that the welcome email and password be sent to the line manager (and this may be the clients choice I believe) this is not feasible, right? The only option I see is send password to Okta Admin email address.
Standard Enterprises may not want to send activation link/password or other comms to the users personal email or store this detail. All that I wanted to do here is once account is provisioned email the users line manager with these details.
Maybe not available OOTB - wondering if anyone else has achieved this.
Hi
You can achieve this via workflow.
Video for reference
https://www.youtube.com/watch?v=U4FXtDP2uGk
Please see the screenshots of Workflow below (this Workflow is working for me)
1) When user is pushed down to on-prem Active Directory
2) Get the user ID and sync state
3) Continue if sync state is "Syncronized" only
4) Read user's profile to get Manager ID (must be defined when user is created in Okta / HR system)
5) Read manager's profile to get the email address
Note : Get a temp passowrd using Okta API (expiring user password in process)
6) Concatenate : string to form a API call
/api/v1/users/
User ID (pulled from 1 card)
/lifecycle/expire_password?tempPassword=true
7) OKta Custom API Call : Post Method - Relative URL is output of card-6 (just drag output field into Relative URL field)
Note : In the Body , type tempPassword to get the temp passowrd for user
8) Compose email
First Name pulled from Manager profile read card (card-5). You can click of setting button on card-5 to add field if not shown.
Okta user name from user profile read card.
Temp Password from Custom API Action card.
9) Construct List action : primary email from Manager's profile read card to email temp password
10) send email.
Note : User has to change password first before access any systems as on-prem AD will set flag "user must change password"
Screenshot in 2 parts 🙂