Problem

With Okta, custom fields or the manager do not sync, users are not deactivated, or a user never appears.

Cause and steps

1. Custom fields do not sync

The attribute in the Okta Profile Editor needs:

  • External Name: custom_fields.<field_name> (lowercase, plural custom_fields)
  • External Namespace: urn:ietf:params:scim:schemas:extension:freshservice:2.0:User

Do not add the field name to the namespace. Find the field name in Freshservice Admin > Apps > Okta provisioning (SCIM) > Settings, in the table below the token. Delete the wrong attribute, create it again with these values, update the mapping and force a sync for one user.

2. Manager does not sync

Okta must send the manager's email address, not an ID or a name.

  • Attribute name: managerValue
  • External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
  • External name: manager.value

Provision the manager into Freshservice before the direct reports. Users who were already provisioned are not updated until a change event happens. Remove the user from the app group, wait a few minutes and add them again.

3. Users are not deactivated

The native Freshservice app in the Okta catalogue does not deactivate users. Deactivation must be done by hand in Freshservice. To automate it, create a custom SCIM app in Okta with your Freshservice SCIM base URL and OAuth token. The native app and the custom app cannot run at the same time, so turn off the native app first.

4. A user never appears

Okta provisions only users (or groups) assigned to the app. Assign the user or their group on the Assignments tab and check that Create Users is on.

5. After a reinstall

Paste the new OAuth token in Okta under Provisioning > API Integration. See OAuth Token Expired or Not Authorized Error: How to Fix.

Problems inside Okta itself, such as a missing app in the catalog or the error "Cannot create application instance", are handled by Okta support or your Okta account team.

Sources

  • KB: OAuth Token Expired or Not Authorized Error: How to Fix
  • KB: Users Deactivated in Freshservice: How to Find the Cause