User16240252019802824362 (Customer) asked a question.
OKTA API Not Showing Active Directory Groups After Syncing
I'm having an issue with the OKTA API not returning data when a client syncs their OKTA users with Active Directly.
Here is the issues; Client will sync Active Directory with OKTA. I check the OKTA API for the changes and they don't show. Then I ask the client to view the user in OKTA and to send a screenshot of the changes. Once they send the screen shot, I'm able to see the changes in the OKTA API. I don't make any changes to my code or the way things are called. So I'm guessing when the client views the user in OKTA, some cache is cleared in the API and the data syncs correctly.
Has anyone else experience this before?
@User16240252019802824362 (Customer) - Viewing stuff in the UI is going to also be an API call to the same endpoint. I am more curious about your process being utilized. Are you directly querying a user or doing a "Search" against something and not returning results? Also, what is the timing here? You kick off a sync and then immediately call the API or do you wait some period of time?
In Okta UD any time a users profile is updated it is going to result in: user.account.update_profile event. If that event hasn't occurred yet (isn't visible for the user in the System Log) then I wouldn't expect the values to have been changed.
The reason I mentioned search is due to the note in the API documentation for filtering:
Note: Results from the filter parameter are driven from an eventually consistent datasource. The synchronization lag is typically less than one second.
Meaning there is an expected lag. However, this won't occur if you are querying the user directly so /api/v1/users/OktaUserId would be a non-cached version of the data.
I don't think it happens all the time. When the client has issues there will be some time that has passed after they have synced with Active Directory. They will have finished the sync, encounter the error and the email me.
I'm using oktaApi.Client.Groups.ToListAsync(); in c# to get a list of groups that the clients has. Then I will get the list of users that are assigned to the groups to map on my side. When search the list of groups that is returned in the code, I don't see see the mapping between group and user. I will then ask the client to send a screenshot of the user in OKTA. After they send the me screenshot, I'm able to see the mapping in my code without changing anything. It's one reason why I was wondering if there was any caching happing.
@User16240252019802824362 (Customer) - The SDK is outside my area of expertise. I am not sure exactly how that call functions or what it's expectations are. The behavior you described does sound a lot like the "List Users" behavior I mentioned previously.
You would likely be better off making the inquiry on the developers forums: https://devforum.okta.com/
Thank you very much for directing me to the dev forums.