Work with Active Directory user profiles and attributes


For Universal Directory, Active Directory (AD) is just another application. That is, AD has its own unique AppAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. User Profile within Okta.

App user profile — Think of the app user profile as a way for Okta and the app, in this case AD, to communicate and agree on which attributes about the app's usersIn Okta literature, we generally refer to "users" as the people who serve as Okta administrators. When we refer to "end users" we are generally referring to the people who the administrators serve. That is, those who use Okta chiclets to access their apps, but have no administrative control. are important. The app user profile is a list of attributes (for example: first name, last name, email) that both the app and Okta need to know about each user.

Attribute mapping — Because AD and Okta may call these attributes by different names, the attribute mapping is the way AD and Okta understand how they each interpret specific attributes. AD needs to know that the AD attribute givenName is the same as firstName in Okta. And Okta needs to know that if it is looking for the attribute email, the AD equivalent is mail.

Expressions/Transformations — Expressions allow you to concatenate attributes, manipulate strings, convert data types, and more. If there are no direct equivalent attributes, either in AD or Okta for a specific attribute, you can use data transformations to tell AD or Okta what the matching attribute is. For example, the AD attribute cn has no direct equivalent in Okta. So you need to use the Okta Expression Language to create a translation so AD knows that the equivalent of its cn is the combination of the Okta attributes user.firstName + user.lastName.

To understand how UD and Profile Editor work to help you manage user profiles and attributes, see About Universal Directory and user profiles.

This topic includes the following information:

  • Adding and Removing Custom AD attributes — Customize which AD attributes are included in the AD/Okta user profile.
  • Base AD attributes — List of the 10 basic attributes that AD requires. All other AD attributes are considered custom attributes.
  • Active Directory attribute mappings — Table of how the AD attributes map to Okta attributes. As you are building your Okta/AD user profile you will need to know how the AD attributes map to Okta attributes.
  • Mapping Profile attributes — How to create a mapping between an Okta user profile and an app user profile
  • Expressions — How to configure expressions, override usernames, and exclude AD user name updates during provisioning.





Top