<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D51Y0000AFsfdTSQROkta Classic EngineUniversal DirectoryAnswered2024-04-28T23:42:44.000Z2021-01-11T19:22:13.000Z2021-05-04T06:20:00.000Z

CharbelA.38457 (Customer) asked a question.

Profile Mastering Source

I'm trying to understand how profile mastering priority works. I read about it but I have couple questions, if you can please help.

 

1- Let's say we have master profile that have 2 source profiles (LDAP) and (AD). LDAP has the highest priority and AD the lower one.

Q: if attribute is not found in highest priority(LDAP)? Does it populate it from the second highest(AD) ? or how does that works?

 

2- When we select the "Attribute" from the "User Profile" in the Profile editor, we can select the Master Priority -->("Inherit From Okta", "Inherit from Profile Master", "Override Profile Master"

Q: Wondering how can I accomplish what's described in the text below. I'm guessing I have to use the "Override Profile Master"? since the "Inherit from Profile Master" does not specifically say from which directory this attribute should be sourced (since it's based on the sourced "Priority")

 

 

"For example, an Okta user may have their profile attributes like first namelast name, and department sourced from Workday. With attribute-level sourcing, their phone number and email address can be sourced from Active Directory, and their personal email address or preferred display name can be sourced from Okta and managed by the end user."

 

https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-about-attribute-mastering.htm


  • MikeM.89811 (Guidewire)

    1- I believe you are correct that it will populate from the second highest.

    2- You would use the override setting and setup a priority list for that specific attribute. Inherit from profile master means that it will use the default profile master ordering. If you edit the Okta user profile, you will see a "profile master priority". This is the default priority that you will be overriding.

    Expand Post
    Selected as Best
  • MikeM.89811 (Guidewire)

    1- I believe you are correct that it will populate from the second highest.

    2- You would use the override setting and setup a priority list for that specific attribute. Inherit from profile master means that it will use the default profile master ordering. If you edit the Okta user profile, you will see a "profile master priority". This is the default priority that you will be overriding.

    Expand Post
    Selected as Best
  • Quick addendum:

    1. Profiles can be a hybrid, particularly if a user starts off with one Profile Master(LDAP) and then gets switched to another Master(AD). Any attributes custom to the original LDAP mastery will only be updated by an LDAP Import. The other base attributes, now AD mastered, will be updated dynamically each time a user DelAuths or by an AD Import. Be cautious in these scenarios if using JIT and not regular imports from the original master. In our use case, the LDAP attributes would be stale as only the AD profile attributes would be updated during DelAuth. Regular LDAP imports will solve this dilemma.

    2. This feature is called Attribute Level Mastery (ALM) allowing a user to have a base Profile Master while other attributes can be updated by other sources. A common example is Okta profiles mastered by a HRM while work Email and work Phone are mastered by AD where tools are used to establish unique values for both. It is also a common use case to write those AD derived values back to the HRM from Okta. Another may be to allow an Okta user to update their Mobile Phone number if mobile devices are "bring your own." This would allow the user to keep their personal phone number updated within their Okta profile while the rest of the profile is mastered by the HRM or AD.

     

    Expand Post
This question is closed.
Loading
Profile Mastering Source