RodrigoP.41140 (Customer) asked a question.
Quick question
Hi, do you guys know about the steps for implementing a callback to an Active Directory in order to pull manager information for user profiles, which is relevant to the ITSM integration.
- Mihai Negoita - Okta (Okta, Inc.)
Hi @RodrigoP.41140 (Customer) , Thank you for reaching out to the Okta Community!
Assuming I've understood your request correctly, and you are looking to leverage Okta Workflows to push the user's manager value into a downstream ITSM service, you will need to keep in mind that Okta Workflows does not have a direct connector to manage on-premises Active Directory.
I don't have real world examples for this, so I recommend checking with the Okta Workflows Discussion group for insights, but as a high-level concept you can look into implementing the following:
1.Map the AD Manager Attribute to Okta UD via custom attribute:
In the Okta Admin Dashboard, navigate to Directory > Profile Editor. Select your Active Directory instance and map the AD manager (which passes the Distinguished Name/DN) or managerUpn attribute to a custom attribute in the base Okta User Profile (e.g., ad_manager).
2.Configure the Workflow Trigger:
In Okta Workflows, add a trigger. For automated ITSM provisioning, typically use the Okta - User Created or Okta - User Profile Updated event card.
3.Read the Target User's Profile:
Add an Okta - Read User card. Pass the Okta User ID from the trigger card into this card. Select your custom ad_manager attribute in the output fields to retrieve the AD manager's DN or UPN.
4.Resolve the Manager's Identity:
ITSM systems require the manager's actual identity record, not just an AD string. Add an Okta - Find Users (or Search Users) card. Search Okta UD for the profile that matches the ad_manager string (e.g., searching by active_directory_dn or email) to extract the manager's Okta ID or primary email address.
5.Push to the ITSM System:Format data for your specific ITSM connector.
Add your specific ITSM connector card (e.g., ServiceNow - Update Record or Jira Service Management - Update Customer). Map the target user's ID and the resolved manager's ID/Email into the corresponding "Manager" field payload.
If your ITSM service can be implemented as an OIN (Okta Integrations Network) app with Provisioning support, you can use the out of the box Provisioning features to push profile data downstream (still dependent of the custom AD attribute mapping). You will need to check the available documentation specific to your service provider.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added
Expand Post
Hi @RodrigoP.41140 (Customer) , Thank you for reaching out to the Okta Community!
Assuming I've understood your request correctly, and you are looking to leverage Okta Workflows to push the user's manager value into a downstream ITSM service, you will need to keep in mind that Okta Workflows does not have a direct connector to manage on-premises Active Directory.
I don't have real world examples for this, so I recommend checking with the Okta Workflows Discussion group for insights, but as a high-level concept you can look into implementing the following:
1.Map the AD Manager Attribute to Okta UD via custom attribute:
In the Okta Admin Dashboard, navigate to Directory > Profile Editor. Select your Active Directory instance and map the AD manager (which passes the Distinguished Name/DN) or managerUpn attribute to a custom attribute in the base Okta User Profile (e.g., ad_manager).
2.Configure the Workflow Trigger:
In Okta Workflows, add a trigger. For automated ITSM provisioning, typically use the Okta - User Created or Okta - User Profile Updated event card.
3.Read the Target User's Profile:
Add an Okta - Read User card. Pass the Okta User ID from the trigger card into this card. Select your custom ad_manager attribute in the output fields to retrieve the AD manager's DN or UPN.
4.Resolve the Manager's Identity:
ITSM systems require the manager's actual identity record, not just an AD string. Add an Okta - Find Users (or Search Users) card. Search Okta UD for the profile that matches the ad_manager string (e.g., searching by active_directory_dn or email) to extract the manager's Okta ID or primary email address.
5.Push to the ITSM System:Format data for your specific ITSM connector.
Add your specific ITSM connector card (e.g., ServiceNow - Update Record or Jira Service Management - Update Customer). Map the target user's ID and the resolved manager's ID/Email into the corresponding "Manager" field payload.
If your ITSM service can be implemented as an OIN (Okta Integrations Network) app with Provisioning support, you can use the out of the box Provisioning features to push profile data downstream (still dependent of the custom AD attribute mapping). You will need to check the available documentation specific to your service provider.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added