<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D54z00009VexFUCAZOkta Classic EngineIntegrationsAnswered2023-07-28T12:49:36.000Z2023-07-24T08:38:57.000Z2023-07-28T12:49:36.000Z

Sri KrishnaA.19789 (Customer) asked a question.

User deletion SCIM integration issue- Not getting the Delete/ Deprovision API calls from OKTA to my APP

Okta is unable to deactivate a user through the SCIM connector. I have enabled the de-provisioning i.e Deactivate Users.

 

/help/servlet/rtaImage?refid=0EM4z000006vs6X

 

I'm able to see a few logs where OKTA is sending a few API calls for get n user addition.

 

https://dev-35738799-admin.okta.com/

 

Can anyone help me out with this?

 


  • NOTE: This is what I have implemented to de-provision the user:

     

    @RequestMapping(value = "/scim/v2/Users/{userId}", method = RequestMethod.PATCH)

    public @ResponseBody Map singleUserPatch(@PathVariable("userId") String userId,

    @RequestBody Map<String, Object> patchPayload) {

     

    logger.info("inside singleUserPatch {}", userId);

    logger.info("payload : {}", patchPayload.toString());

     

    List<Map> operations = (List) patchPayload.get("Operations");

    List<String> schemas = (List<String>) patchPayload.get("schemas");

     

    // Check if operations and schemas are present in the payload

    if (operations == null || operations.isEmpty()) {

    logger.info("Payload must contain operations attribute");

    return scimError("Payload must contain operations attribute.",

    Optional.of(HttpStatus.BAD_REQUEST.value()));

    }

    if (schemas == null || schemas.isEmpty()) {

    logger.info("Payload must contain schemas attribute");

    return scimError("Payload must contain schemas attribute.",

    Optional.of(HttpStatus.BAD_REQUEST.value()));

    }

     

    // Verify schema

    String schemaPatchOp = "urn:ietf:params:scim:api:messages:2.0:PatchOp";

    if (!schemas.contains(schemaPatchOp)) {

    logger.info("The 'schemas' type in this request is not supported.");

    return scimError("The 'schemas' type in this request is not supported.",

    Optional.of(HttpStatus.NOT_IMPLEMENTED.value()));

    }

     

    boolean deactivateUser = false;

     

     

    logger.info("Checking if Deactivate User is specified");

    for (Map operation : operations) {

     

    logger.info("Specified Operation {}", operation.toString());

     

    String op = (String) operation.getOrDefault("op", "");

    String path = (String) operation.getOrDefault("path", "");

    Object value = operation.getOrDefault("value", false);

     

    if ("remove".equals(op) && "active".equals(

    path) && value instanceof Boolean && !(Boolean) value) {

    deactivateUser = true;

    break;

    }

    }

     

    if (deactivateUser) {

    logger.info("Deactivate Request for SCIM user is called");

    ResponseEntity<Object> objectResponseEntity = userAdapter.deleteSCIMUser(userId);

     

    if (objectResponseEntity.getStatusCode().equals(HttpStatus.BAD_REQUEST)) {

    return scimError("Unable to delete the user", Optional.of(HttpStatus.BAD_REQUEST.value()));

    }

    } else {

    logger.info("Update Request for SCIM user is called");

    }

     

    // Construct and return the response

    User newUser = null;

    try {

    newUser = new User(patchPayload);

    } catch (Exception e) {

    logger.error(e.printStackTrace());

    }

     

    return new User.toScimResource();

    }

    Expand Post
  • Mihai N. (Okta, Inc.)

    Hi @Sri KrishnaA.19789 (Customer)​ , Thank you for reaching out to the Okta Community!

     

    This questions might be more appropriate for our dedicated Developer forum. 

    My advice would be to reach out to devforum.okta.com to take advantage of their expertise. 

    While we'll do our best to answer all of your questions here, this medium is more inclined towards Okta core products and features (non-developer work). 

     

    I've looked a bit into this and have seen a couple of similar reports there: 

    https://devforum.okta.com/t/scim-deprovisioning-not-sent-to-integration/22691/8

    https://devforum.okta.com/t/provisioning-deactivate-user-not-calling-scim/2330

     

    I recommend providing my colleagues with more details/context about the implementation and connector used.  

     

    In the meantime, you can also check the following troubleshooting guide for any relevant info that might apply to your use case:

    https://support.okta.com/help/s/article/Provisioning-Or-Deprovisioning-Error-Okta-To-App-What-Do-I-Do?language=en_US

     

     

     

    If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

     

    Hope my answer helps! 

    --------------------------------

    Community members help others by clicking Like or Select as Best on responses. Try it today.

    Expand Post
This question is closed.
Loading
User deletion SCIM integration issue- Not getting the Delete/ Deprovision API calls from OKTA to my APP