User17387660153119033921 (Customer) asked a question.
Missing Member And Group Fields in SCIM Provisioning Requests
I am currently integrating SCIM provisioning with OKTA in my application, and I have encountered an issue related to group and user synchronization.
When OKTA sends a request to create a user in my SCIM API, the "groups" field is missing in the payload. Similarly, when a request is sent to create a group, the "members" field is empty. This makes it difficult to properly associate users with their respective groups in my system.
Expected Behavior:
- When OKTA provisions a user, I expect the "groups" field to contain the list of groups the user belongs to.
- When OKTA creates a group, I expect the "members" field to contain the list of users assigned to that group.
Current Behavior:
- User creation requests do not include the "groups" field.
- Group creation requests contain an empty "members" array.
Questions & Assistance Needed:
- Is there a specific setting in OKTA that needs to be enabled to include group memberships in user creation requests?
- For group creation, is there a way to ensure that OKTA sends the list of members in the initial provisioning request?
- Are there any workarounds or recommended best practices to retrieve this data separately if OKTA does not send it by default?
- Could this be related to the way my SCIM API is configured or the OKTA application settings?
Any guidance or suggestions would be greatly appreciated!
Hello @User17387660153119033921 (Customer) Thank you for posting on our Community page!
Creating groups and providing the group membership from Okta to an application is done though Group push. Using group push Okta will send the group membership for a user only for the group that he is part of and if these groups are setup as Group Push.
For example, if user test@company.com is part of groups A, B, C and D, but the application only has group B and D setup as group push in the application, group membership will be sent only for group B and D, group membership for group A and C will not be sent even if the user is part of these groups.
Please also see our doc on group push below:
https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-about-group-push.htm
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.