Okta Expression Language using isMemberOfGroup or isMemberOfGroupName Does Not Trigger Mapping Updates
Last Updated:
Overview
Universal Directory (UD) mappings using Okta Expression Language (OEL) group functions do not trigger mapping updates because Okta does not integrate these functions to trigger updates automatically. Use Group Rules and Group App Assignments to manage application user profile updates when group memberships change. Specifically, UD mappings using OEL group functions, such as isMemberOfGroup or isMemberOfGroupName, fail to trigger UD mapping updates.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Universal Directory (UD)
- Okta Expression Language (OEL)
Cause
Okta does not integrate Okta Expression Language group membership functions to trigger Universal Directory mapping updates. Consequently, Okta does not update or reapply the profile attributes in the AppUser profiles when the user's group membership changes.
Solution
How are profile updates managed when group memberships change?
Manage application user profile updates using Group Rules and Group App Assignments by following these steps.
- Use Group Rules to manage application user profile updates when Group App Assignment changes the group memberships.
- Set the value in the Group App Assignment and assign the attribute by group priority if the attribute type in the application is a Group type and not Personal.
- Direct the Group App Assignment using a Group Rule condition so that it updates when the group condition changes.
NOTE: Do not create cascading Group Rules. Cascading rules cause performance issues because they refer to a group that Okta populates through another rule. See Group rules best practices.
