Pierre-OlivierV.03332 (Customer) asked a question.
SCIM - Push Group is not syncing back to the application when a user is removed from the group
Hi,
While testing out SCIM with Okta, I stumbled upon what I think is a bug.
Repro steps
- Create 10 users.
- Add the 10 users to a group call "App Users".
- Add 3 of the 10 users to a group call "App Admins".
- On your application, add "App Users" under Assignment. All 10 users will be synced to the application.
- On your application, add "App Admins" under Push Groups. The "App Admins" group is pushed to the application and all 3 users are assigned to the group in app.
- Remove 1 user from "App Admins".
- The user is still found in "App Admins" group in my application.
Expected behavior
The user should not be part of "App Admins" anymore in the application, but it still is. I would expect the user to still be in my application, but not inside the "App Admins" group since it was removed on Okta's side.
Extra note
- I logged the request body from Okta in that scenario (removing 1 user from "App Admins") and Okta sent all 3 users, not the expected 2 users left in the "App Admins" group.
- According to Okta's documentation, this setup of having 2 groups is the way to go: https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-group-push-troubleshoot.htm
Thank you!
Hi @Pierre-OlivierV.03332 (Customer) , Thank you for reaching out to the Okta Community!
This question is more appropriate for our dedicated Okta Developer Forum.
My advice would be to reach out via devforum.okta.com to take advantage of their expertise.
While we'll do our best to answer all of your questions here, this medium is more inclined towards Okta general questions around core products and features (non-custom/developer work).
I'm suspecting this has something to do with what type of application you currently have configured:
Application Integration Wizard (AIW) app template versus the dedicated "Okta SCIM 2.0 templates" ;
> the AIW ones send Group Operation requests as PUT and our developer colleagues recommend using "Okta SCIM 2.0 templates" because they use PATCH requests.
Something similar to what is being reported in this devforum post.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added