Work with Active Directory user profiles and attributes

For Universal DirectoryUniversal Directory enables you to store an unlimited amount of users and attributes from applications and sources like AD or HR systems. Any type of attributes are supported including linked-objects, sensitive attributes, and pre-defines lists. All of it accessible by all apps in our OIN catalog, over LDAP or via API., Active DirectoryActive Directory (AD) is a directory service that Microsoft developed for the Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. (AD) is just another application. That is, AD has its own unique AppAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. User Profile within Okta.

App user profile — Think of the app user profile as a way for Okta and the app, in this case AD, to communicate and agree on which attributes about the app's users are important. The app user profile is a list of attributes (for example: first name, last name, email) that both the app and Okta need to know about each user.

Attribute mapping — Because AD and Okta may call these attributes by different names, the attribute mapping is the way AD and Okta understand how they each interpret specific attributes. AD needs to know that the AD attribute givenName is the same as firstName in Okta. And Okta needs to know that if it is looking for the attribute email, the AD equivalent is mail.

Expressions/Transformations — Expressions allow you to concatenate attributes, manipulate strings, convert data types, and more. If there are no direct equivalent attributes, either in AD or Okta for a specific attribute, you can use data transformations to tell AD or Okta what the matching attribute is. For example, the AD attribute cn has no direct equivalent in Okta. So you need to use the Okta Expression Language to create a translation so AD knows that the equivalent of its cn is the combination of the Okta attributes user.firstName + user.lastName.

To understand how UD and Profile Editor work to help you manage user profiles and attributes, see About Universal Directory and user profiles.

This topic includes the following information:

  • Adding and Removing Custom AD attributes — Customize which AD attributes are included in the AD/Okta user profile.
  • Base AD attributes — List of the 10 basic attributes that AD requires. All other AD attributes are considered custom attributes.
  • Active Directory attribute mappings — Table of how the AD attributes map to Okta attributes. As you are building your Okta/AD user profile you will need to know how the AD attributes map to Okta attributes.
  • Mapping Profile attributes — How to create a mapping between an Okta user profile and an app user profile
  • Expressions — How to configure expressions, override usernames, and exclude AD user name updates during provisioning.