<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D5WR000018SGEc0AOOkta Classic EngineIntegrationsAnswered2026-01-30T16:59:08.000Z2026-01-06T01:28:24.000Z2026-01-30T16:59:08.000Z

NareshG.80393 (Customer) asked a question.

okta org2org saml setup with SCIM and getting Unable to transform email to username

I am new to OKTA. I have configured OKTA Org2org setup with SCIM. The IDs are successfully created on the target.

When I am testing SAML and it is not working, I receive this error in the logs: Unable to transform email to username.

I tested this setup with JIT instead of SCIM and working well.

I am using this idpuser.subjectNameId in IDP setup and matching with OKTA username but no luck.

Could someone please help me if I missed anything?

 


  • Hi @NareshG.80393 (Customer)​ , Thank you for reaching out to the Okta Community! 

     

    You can review the Org2Org implementation documentation here. Depending on your organization's requirement, I would recommend the API token model of Provisioning which is typically more straightforward and simple to configure. 

    If you are looking for a custom SCIM implementation, please reach out to our Developer colleagues via devforum.okta.com, as this would be their purview. 

    In the meantime, you can check the Okta System Logs to review additional details as to what might be mismatching. Also check your attribute mappings on both sides (hub/spoke orgs) under Okta Admin Dashboard > Directory > Profile Editor > "org2org integration name".  

     

     

     

     

    If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

     

    Hope my answer helps! 

     

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Collect them all. Learn a new skill and earn a new Okta Learning badge.

    Just released: More Okta Community badges just added

    AMA Alert: Starting the Year Strong with Stronger Authentication (MFA) Adoption

    Expand Post
    Selected as Best
  • NareshG.80393 (Customer)

    Hi @Mihai Negoita - Okta (Okta, Inc.)

    ​ Thank you for your response. yes I am suing the API token for the SCIM.

    I didn't see any issue with the SCIM. I have manually searched for the OKTA user in the target OKTA, and both are identical. But when the end user logs in to the application this is failing and not able to find that.

    I didn't find any mapping issue. I got the below in the target logs.

     

    "target": [

      {

       "id": "unknown",

       "type": "AppUser",

       "alternateId": "alexandra.cooper@oktacertified.com",

       "displayName": "Alexandra Cooper",

       "detailEntry": null

      },

      {

       "id": "0oacoy3jz0C8kuihU0x7",

       "type": "AppInstance",

       "alternateId": "IDprov",

       "displayName": "SAML 2.0 IdP",

       "detailEntry": null

      }

     "debugContext": {

      "debugData": {

       "authnRequestId": "95ce38c8788f794a0bd829001311cdef",

       "requestId": "f31008c39e29388d3eb34f585ba481ee",

       "dtHash": "d6dc921418b344e6aacbd463e1a49c27cf4c4ccdd88f81ae64090d90813c8741",

       "requestUri": "/idp/idx/introspect",

       "threatSuspected": "false",

       "transformedUserName": "alexandra.cooper@oktacertified.com",

       "url": "/idp/idx/introspect?"

      }

     

    Expand Post

Loading
okta org2org saml setup with SCIM and getting Unable to transform email to username