Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Bug]: Okta directory sync doesn't say app-profile attributes need SCIM mappings, so users can sync with no display name or email

未关闭 适合新手
  • 哪里不对？
#1,281 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@danbarr 已经在做这个了。

开始于 2026年10月29日。

  • #1291 来自 @danbarr —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
78/100
Issue 类型
文档
描述清晰度
描述清楚
活跃度
活跃
技术栈
javascript
领域
authentication, documentation

调研方向

阅读 docs/platform/enterprise-directory/okta-directory-sync.mdx 和其中引用的 internal/directory/domain/models/okta_app_profile_schema.go 的行为说明。更新 Prerequisites、Verify synchronization 和 Troubleshooting，解释必需的 SCIM 属性映射，添加建议的用户和 API 检查，并交叉链接到 SCIM 组指南。页面完成的标准是：清楚说明缺少 display name、email 和派生组属性的原因及修复方法。

由索引模型根据 Issue 内容生成。

描述

bug documentation needs-triage
Page or section

docs/platform/enterprise-directory/okta-directory-sync.mdx (Prerequisites, Verify synchronization, Troubleshooting)

What's wrong?

The prerequisites say: "Configure its profile mappings so the application user profile contains every attribute that you want in the directory." That isn't enough. The reconciler only projects application-profile properties that have a SCIM destination in the app-user schema (externalName and externalNamespace from GET /api/v1/meta/schemas/apps/{appId}/default). Properties without one are skipped silently (internal/directory/domain/models/okta_app_profile_schema.go, NewOktaAppProfileSchema). In practice, Okta only populates those SCIM destinations on an application with SCIM provisioning enabled.

userName is always set from the base user's profile.login, so a reconciler pointed at a plain OIDC sign-in app still "works": users appear with a SCIM source and the verification steps pass. But they have no displayName and no email. That's the state of the demo cluster today. Every user shows their login as their name, with an empty email column. That cascades into:

  • user names falling back to UUIDs where a view needs an email (see stacklok/stacklok-enterprise-platform#5447)
  • group_variables such as department and costCenter producing no groups, so AI Gateway group labels (directory.groupLabels) resolve to nothing

The page's troubleshooting section doesn't cover this case, and nothing in the logs flags it.

Suggested fix
  • Prerequisites: say that the target application must have SCIM provisioning enabled (or otherwise expose SCIM externalName mappings), and that its Provisioning > To App mappings must populate at least displayName and the primary email. Note that the reconciler doesn't push to the app; the provisioning settings only supply the attribute mappings.
  • Verify synchronization: add a check that synced users have a display name and email in User management, and an optional API check: GET /api/v1/meta/schemas/apps/<APP_ID>/default should show an externalName for displayName and email.
  • Troubleshooting: add "Users appear without a display name or email", with the cause and fix above.
  • Cross-link to SCIM provisioning's "Create groups from user attributes" and "Label derived groups", noting that department and costCenter need the same mappings to produce groups and AI Gateway attribution labels.
Additional context

Code and design references in stacklok/stacklok-enterprise-platform: enterprise/toolhive-enterprise/docs/design/okta-directory-reconciler.md ("Profile translation"; userName comes from profile.login because "the observed application profile does not expose a userName destination"). Found while walking through demo flows on the demo cluster, which uses the pull reconciler. Standing environments use push SCIM from a SCIM app and don't show the problem.

Fully or partially written by an AI agent.

主要语言
JavaScript
星标
4
派生
4
平均合并
19 小时 20 分钟
30 天内合并 PR
85

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

stacklok/docs-website 的其他 Issue

查看 stacklok/docs-website 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。