ShivamM.84745 (Customer) asked a question.
Hi,
Let me begin by sharing the app integration details and observed behaviour.
Application integration details - We have a SAML integrated application in Okta. Okta is sending basic user details via SAML attributes and we have created 2 custom SAML attributes in application profile mapping - role (enum values) and a group (via group assignment). We are sending these 2 custom attributes to the application via SAML assertion using appuser.role and appuser.group expression. We are not using provisioning integration for this app (just saml sso and role assignment is managed from okta)
Behavior - When we try to edit the user that's is already assigned to this application (via group assignment), Okta shows a banner "There is 1 mapping change that has not been applied. To edit this assignment, reapply mapping.". When we re-apply mapping, the selected value of the role is reset. (No change to the mapping was done or mapping between okta and target app is not even been used since we aren't using provisioning integration for this application)
For newly added users to the app group, we don't see the above message to reapply mapping.
Has anyone faced similar behaviour?
Any inputs or guidance is appreciated.
Thank you.
Hi @ShivamM.84745 (Customer) , Thank you for reaching out to the Okta Community!
If the application does not use a Provisioning integration, Profile mappings (via Okta Admin Dashboard → Directory → Profile Editor) are not necessary and even if they are set up, they effectively do nothing.
To pass attributes to the downstream app, you would use the SAML Assertion and for that you would need to implement additional attribute statements via the App's General → SAML Settings tab.
You might want to consider disabling mappings to get rid of the banners.
That being said, I do not have knowledge or access to your overall implementation and dependencies, so I would recommend opening a case to have one of our Support Engineers review the matter with you before making any changes.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Okta Identity Engine (OIE) Ask Me Anything: Get answers from product experts by clicking here.