Hello and thank you for reading this,
We have a situation where we need to use Okta Provisioning. Using provisioning puts this user into the root branch. Is there a way we can force these Okta users into a specific branch?
Our new users will not know what branch they are assigned yet. They will be required to enter
first name, last name, and email address, from there can they be put into a default branch?
Thank you,
Best answer by pmo
View original
+7
HI
+2
If I understand you correctly
In most cases when clients are using SSO and User Provisioning they’re provisioning from some sort of HRS system and their branch structure (Branch names, codes, hierarchy) is configured to match the hierarchy in their HRS system. This is because when we provision users we can map “Branch Name” or “Branch Code” to some field in the HRS (for instance like “Department”). So when a user is provisioned via okta the user will be slotted into their “Department” branch.
It’s not clear from your post whether you have that information so let’s assume you didn’t and instead you wanted all users provisioned via OKTA to land in an “Employee” branch. You could create an attribute/custom field in OKTA called “Branch Name” and then manually assign a value of “Employee” to that field for all users in OKTA. Next you would just need to map that field in the SSO app and ensure that you’re passing those OKTA attributes in your claims.(Some of these details on the sso configuration are a bit murky so I would rely on Docebo Support and your IT team to verify.). The next time the user logs in or the next time a new user is provisioned they should be sorted into the correct branch.
Thank you for that collegiate try Irnlab! Not really importing, sort of like a self registration but they exist in our Active Directory but not onboarded yet to Docebo.
We have a Branch_name field in Okta, and linked it to a specific branch in Docebo using that table showed above that you posted, but it didn’t work.
If fact only the username worked, the rest of the fields didn’t work: first name, last name, email address, or branch. Docebo put this new user into root branch without adding the attributes..
Except for the username the attributes are not populating. I missing something, can’t put my finger on it.
Yes: for users not onboarded in Docebo they will be provisioned using provisioning and OKTA.
We are using a Okta test user with premade attributes. The user has first name, last name, and email address already setup in OKTA, the provisioning did not bring that over.
I hope this described it better.
+2
Support will be able to turn on saml logging and then have you conduct a test and review how the claims are being passed, formatted and what attributes and attributes names are being passed.
In the meantime I would verify the following:
Good Idea about the logging. I’m realizing it starts with the attributes. I’m starting to figure it out how to map them and got two working.
We can consider this closed. Thank you all for your support and quick replies.
+2
Could do our community manager a favor and mark one of the replies as “best answer”. This helps us track what threads might need some additional help and which threads we would consider “closed”.
Thanks!
I am currently struggling with this exact problem using Azure AD, not Okta. However, new users that are not in the LMS aren’t even able to use the SSO button. Existing users are able to sign in with the SSO button.
+2
“However, new users that are not in the LMS aren’t even able to use the SSO button”
Do you have user provisioning box checked in your SAML app?
I do have the User Provisioning box checked.
Enter your email address or username and password below to log in to Docebo Community. No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
