<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D54z000099QCr1CAGOkta Classic EngineLifecycle ManagementAnswered2023-06-29T11:26:49.000Z2023-05-04T10:04:08.000Z2023-05-11T09:22:46.000Z

DamianZ.25071 (Customer) asked a question.

May 4, 2023 at 10:04 AM
Is it possible to override groupKey for groups which are pushed to Google?

In our organization we have a group naming convention, which contains two colons (::) as a separator. 

Example name of the group may be: Project::Department::Division.

 

Now we are trying to integrate provisioning users and groups into Google Workspace and have a problem.

It is impossible to push such groups to Google - we are getting an error:

 

Failed on 05-04-2023 09:33:09AM UTC: Unable to update Group Push mapping target App group Test::Simple Group: Failed to create group Test::Simple Group. Invalid Input: groupKey

 

So my question is: Is it possible to override groupKey parameter for groups? I would rather set up additional parameter than change the whole naming convention.

  • 5 answers
  • 491 views

  • DamianZ.25071 (Customer)

    After couple of days I figured out some workaround, which solves our business case for this.

    I'll leave the comment here - if it will be useful for someone.

     

    So, at the beginning let's make some assumptions:

    1. In Okta we have at least 2 applications integrated, one of them is Google Workspace;
    2. We want groups to be pushed to Google automatically (using rules);
    3. We are naming our groups in a way which is not properly handled with Google Workspace;
    4. We don't want to change our groups naming convention 🙂

     

    Ok, so the resolution for that issue will be:

    1. Creating proper rules for pushing groups within all applications (including Google); Eg. We can set up that all groups starting with "Project::" will be pushed;
    2. For Google we create additional rule to push groups starting with "project-";
    3. Then, when we create a group, initially we naming it as eg. "project-group-task" and then, right after creation, changing the name to "Project::Group::Task" (which should be the group name we actually wanted to have);

     

    In this way:

    1. Group is pushed to Google and Google doesn't complain about groupKey;
    2. After renaming group, the push for it is still active and rules for other applications working;

     

    I have tried this also with API, with a 1s delay between creating a group and renaming it and everything worked as expected.

    Expand Post
    Selected as Best

  • DamianZ.25071 (Customer)

    @paul.stiniguta (Okta, Inc.)​ Thank you for your response. I have tried steps from the instruction you have sent, but it didn't help.

    I think my problem is different, I'm still getting an error:

     

    Failed on 05-08-2023 04:59:53AM UTC: Unable to update Group Push mapping target App group Test::Simple Group: Failed to create group Test::Simple Group. Invalid Input: groupKey

     

    Not this one: Resource Not Found: groupKey

     

    And I believe this is strictly connected with ::, because for test groups without this character everything works good.

    Zrzut ekranu 2023-05-8 o 07.02.08 

    Expand Post

    • paul.stiniguta (Okta, Inc.)

      Could you try to push just the group with no users in it and then add users?

      Also, would it be possible to make sure that the group does not exist on Google side?

  • DamianZ.25071 (Customer)

    Ok, so I have tried this the way you asked. I have created a new group, which doesn't exist on Google side, without any users and tried to synchronize it. Effect for now is the same - an error. Screenshoot Okta ErrorScreenshoot Google Admin PanelYesterday I've been experimenting with other options (because at the end it is very important for me to make this working) and tried creating the group directly in Google - then adding synchronization in Okta panel.

     

    In such case, when group with exact the same name has been already created in Okta, I were able to turn on the synchronization. However the case is that I want the group in Okta to be created with API and then automatically synchronized with all applications (using group pushing rules).

     

    In this case I can't do this, because it takes some time until Okta refreshes groups from Google.

     

    Expand Post

  • DamianZ.25071 (Customer)

    After couple of days I figured out some workaround, which solves our business case for this.

    I'll leave the comment here - if it will be useful for someone.

     

    So, at the beginning let's make some assumptions:

    1. In Okta we have at least 2 applications integrated, one of them is Google Workspace;
    2. We want groups to be pushed to Google automatically (using rules);
    3. We are naming our groups in a way which is not properly handled with Google Workspace;
    4. We don't want to change our groups naming convention 🙂

     

    Ok, so the resolution for that issue will be:

    1. Creating proper rules for pushing groups within all applications (including Google); Eg. We can set up that all groups starting with "Project::" will be pushed;
    2. For Google we create additional rule to push groups starting with "project-";
    3. Then, when we create a group, initially we naming it as eg. "project-group-task" and then, right after creation, changing the name to "Project::Group::Task" (which should be the group name we actually wanted to have);

     

    In this way:

    1. Group is pushed to Google and Google doesn't complain about groupKey;
    2. After renaming group, the push for it is still active and rules for other applications working;

     

    I have tried this also with API, with a 1s delay between creating a group and renaming it and everything worked as expected.

    Expand Post
    Selected as Best
This question is closed.
Loading
Is it possible to override groupKey for groups which are pushed to Google?