SCIM provisioning fails when custom attribute 'roles' is mapped

Hi @MyounghunP.12250 (Customer)​ , Thank you for reaching out to the Okta Community! 

I'm not seeing "roles" as being reserved in the list.

Does the SCIM integration have the "roles" attribute configured under Oka Admin Dashboard > Applications > "SCIM app name" > Provisioning > to app? 

If not, you may need to add it there.

Regards.

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added

Custom attributes are supported in scim 2.0 but under right schema. As long as the schema mentioned while creating custom attributes are entertained by scim server it should work.

If you are building scim, you have full control over how to handle received data. Print the data received and see how it looks and if you need to add additional snippet to handle it.

If it is an enterprise scim with no access to codebase you have to make sure custom attributes variable and schema matches exactly how the scim server would expect.

Updating this response for ease of access and reference:

Okta System for Cross-domain Identity Management (SCIM) 2.0 user provisioning fails during the Create User operation when a custom attribute named roles

maps to the application. This occurs because the custom attribute schema generated by Okta does not match the schema that the SCIM server expects. Resolve this issue by verifying the attribute configuration in the Okta Admin Console and ensuring the schema aligns with the SCIM server requirements.

The following error appears during provisioning:

Automatic provisioning of user okta 02 to app SCIM 2.0 Test App (Header Auth) failed: Error while creating user okta02@monit.com: Bad Request. Errors reported by remote server: The request body message structure was invalid or did not conform to the request schema.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• SCIM 2.0 Provisioning
• Custom Attributes

Cause

The SCIM server rejects the request payload because the custom attribute schema defined in Okta does not match the schema that the SCIM server expects. While roles does not exist as a reserved Okta attribute, SCIM 2.0 defines roles as a core multi-valued complex attribute. Defining a custom attribute with the same name under the core User namespace (urn:ietf:params:scim:schemas:core:2.0:User) causes Okta to generate a request payload that the SCIM server considers invalid.

Solution

How does an administrator verify the SCIM custom attribute schema?

Verify the custom attribute configuration in the Okta Admin Console by following these steps.

1. Navigate to Applications > Applications and select the SCIM application.
2. Go to the Provisioning tab and select To App.
3. Ensure the custom attribute exists and matches the exact schema that the SCIM server expects.

How does Okta handle SCIM 2.0 custom attributes?

SCIM 2.0 supports custom attributes, provided they use the correct schema.

• When building a custom SCIM server, print the received data payload to verify the structure Okta sends and adjust the server code to handle the payload.
• When using an enterprise SCIM server without codebase access, ensure the custom attribute variable and schema match exactly what the SCIM server expects.
• Consider using a custom SCIM extension namespace instead of the core User namespace to avoid conflicts with standard SCIM attributes.