MikeR.91407 (Customer) asked a question.
Hello,
I am seeing something interesting with "User login to Okta" events in our production system logs. Concurrently with these login events, I am seeing the "Okta System User (SystemPrincipal)" user update the user profile for the given user who is logging in (i.e. a user.account.update_profile event is fired). Here's what it looks like when I sign in, for example (these all happen at the same time, the order isn't really relevant here):
In our case, this event is removing a custom attribute from our user's profiles (namely atlassian_account_id). Then, our post-sign-on hook that we have in one of our apps sees that the ID doesn't exist on the user, and sends out a user.account.profile_update and re-adds the ID.
So, every time a user logs in, we are wasting a hit to our rate limit in our post signon hook because we are having to send out a user profile update to revert the one that happened seconds before from the SystemPrincipal user.
My question is, what is the purpose of the SystemPrincipal doing this? Is this something our organization may have set/can it be disabled?
Thanks!
Mike
Hello Mike,
I've escalated your question to our Customer Support team. They will respond to you shortly here.
Thanks!
Tim
Okta, Inc.
Hello Mike,
Judging strictly by the SysLog entries provided within the screenshot you posted, I'd say that that specific IDP has JIT Provisioning enabled, but this would require a bit more looking into, as based on your organizational needs, disabling it might not be the way to go, but rather tweaking the mapping under Directory > Profile Editor would be the way to go.
If the above info has set you on the right track, I'm happy I was able to help, but if you would need further assistance, my best recommendation would be to open a Support Ticket with us, and me or one of my colleagues would be more than glad to further assist you.
Thank You,
Stefan Pescaru
Technical Support Engineer
Okta Global Customer Care
Hi Stefan,
Thanks for your help - this was indeed an issue regarding the attribute and its mapping not existing in our IDP Profile. I created the attribute/mapping in the ID profile and the attribute is no longer being removed with each login.
Thanks again,
Mike