Owners data of Okta groups is not coming while aggregation in IIQ

Which IIQ version are you inquiring about?

8.3p4

Please share any other relevant files that may be required (for example, logs).

Response generated by connector while aggregating:

2025-01-07T12:54:51,834 TRACE QuartzScheduler_Worker-5 openconnector.connector.okta.OktaConnector:97 - Entering prepareGroupRO: Arguments => {id=00g3j8fhx2j0ZzZ3w1d7, created=2022-04-20T22:45:44.000Z, lastUpdated=2022-04-20T22:45:44.000Z, lastMembershipUpdated=2024-12-05T12:58:13.000Z, objectClass=[okta:user_group], type=OKTA_GROUP, profile={name=Platform Prod - Superuser Role, description=null}, _links={logo=[{name=medium, href=https://op3static.oktacdn.com/assets/img/logos/groups/odyssey/okta-medium.30ce6d4085dff29412984e4c191bc874.png, type=image/png}, {name=large, href=https://op3static.oktacdn.com/assets/img/logos/groups/odyssey/okta-large.c3cb8cda8ae0add1b4fe928f5844dbe3.png, type=image/png}], owners={href=https://xxxxsecurity.oktapreview.com/api/v1/groups/00g3j8fhx2j0ZzZ3w1d7/owners}, users={href=https://xxxxsecurity.oktapreview.com/api/v1/groups/00g3j8fhx2j0ZzZ3w1d7/users}, apps={href=https://xxxxsecurity.oktapreview.com/api/v1/groups/00g3j8fhx2j0ZzZ3w1d7/apps}}}, openconnector.Schema@6cb052a7

Resource Object while aggregating:

<!DOCTYPE ResourceObject PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<ResourceObject displayName="Platform Prod - Superuser Role" identity="00g3j8fhx2j0ZzZ3w1d7" objectType="group">
  <Attributes>
    <Map>
      <entry key="applications">
        <value>
          <List>
            <String>0oa3l51e4rMJhd6NA1d7</String>
            <String>0oa3w0p8xjnlH7Xm11d7</String>
            <String>0oa3znbkvqq0VmAIK1d7</String>
            <String>0oa40ltacgmhfIgCy1d7</String>
            <String>0oa4uxcf0pPPmewuH1d7</String>
          </List>
        </value>
      </entry>
      <entry key="created" value="2022-04-20T22:45:44.000Z"/>
      <entry key="description"/>
      <entry key="lastMembershipUpdated" value="2024-12-05T12:58:13.000Z"/>
      <entry key="lastUpdated" value="2022-04-20T22:45:44.000Z"/>
      <entry key="managerApprovalRequired">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>
      <entry key="name" value="Platform Prod - Superuser Role"/>
      <entry key="objectClass">
        <value>
          <List>
            <String>okta:user_group</String>
          </List>
        </value>
      </entry>
      <entry key="ownerApprovalRequired">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>
      <entry key="sysDescriptions"/>
      <entry key="type" value="OKTA_GROUP"/>
    </Map>
  </Attributes>
</ResourceObject>

Share all details about your problem, including any error messages you may have received.

The problem is: We have an Okta application onboarding. I am working on setting up owners for the Okta groups while aggregating. So, I just tried to check if the owners (in the Okta application we have added owners as people) information is coming or not while aggregating. After I checked the logs, I came to know that the connector is able to hit the API and get the response in which owners information is there as a ref as mentioned in the logs below. But while generating ResourceObject, the SailPoint is not able to get the owners’ data. How can we get the owner’s data while group aggregation?

@bhanuprakashkuruva we were able to achive it with custom attribute or existing attribute in okta side , that attribute is also present in our Sailpoint group schema.
First run group aggreation then account and then group first time for new application and it will set the owner as per your logic to calculate owner from xyz group field to link to identity.

I have added ‘owners’ attribute (which is not default attribute comes with schema. I have added it explicitly to group schema, and name of the attribute is also same in Okta) but still not coming.

@bhanuprakashkuruva need to check more , for us it worked and we are able to get okta owner from aggregation. i will check if something i can find.

Sure @mkumariaas , thank you!

What I observed and came to know from SailPoint as well is that the Okta connector supports custom attributes for user profiles; however, group aggregation is not supported for getting the custom attributes for the groups like owners.
I will keep you posted if I find some other way to accomplish it.

1 Like