[Bug]: Okta directory sync doesn't say app-profile attributes need SCIM mappings, so users can sync with no display name or email
维护者通常 1 天内回复
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 78/100
- Issue 类型
- 文档
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- javascript
调研方向
阅读 docs/platform/enterprise-directory/okta-directory-sync.mdx 和其中引用的 internal/directory/domain/models/okta_app_profile_schema.go 的行为说明。更新 Prerequisites、Verify synchronization 和 Troubleshooting，解释必需的 SCIM 属性映射，添加建议的用户和 API 检查，并交叉链接到 SCIM 组指南。页面完成的标准是：清楚说明缺少 display name、email 和派生组属性的原因及修复方法。
由索引模型根据 Issue 内容生成。
描述
Page or section
docs/platform/enterprise-directory/okta-directory-sync.mdx (Prerequisites, Verify synchronization, Troubleshooting)
What's wrong?
The prerequisites say: "Configure its profile mappings so the application user profile contains every attribute that you want in the directory." That isn't enough. The reconciler only projects application-profile properties that have a SCIM destination in the app-user schema (externalName and externalNamespace from GET /api/v1/meta/schemas/apps/{appId}/default). Properties without one are skipped silently (internal/directory/domain/models/okta_app_profile_schema.go, NewOktaAppProfileSchema). In practice, Okta only populates those SCIM destinations on an application with SCIM provisioning enabled.
userName is always set from the base user's profile.login, so a reconciler pointed at a plain OIDC sign-in app still "works": users appear with a SCIM source and the verification steps pass. But they have no displayName and no email. That's the state of the demo cluster today. Every user shows their login as their name, with an empty email column. That cascades into:
- user names falling back to UUIDs where a view needs an email (see stacklok/stacklok-enterprise-platform#5447)
group_variablessuch asdepartmentandcostCenterproducing no groups, so AI Gateway group labels (directory.groupLabels) resolve to nothing
The page's troubleshooting section doesn't cover this case, and nothing in the logs flags it.
Suggested fix
- Prerequisites: say that the target application must have SCIM provisioning enabled (or otherwise expose SCIM
externalNamemappings), and that its Provisioning > To App mappings must populate at leastdisplayNameand the primary email. Note that the reconciler doesn't push to the app; the provisioning settings only supply the attribute mappings. - Verify synchronization: add a check that synced users have a display name and email in User management, and an optional API check:
GET /api/v1/meta/schemas/apps/<APP_ID>/defaultshould show anexternalNamefordisplayNameandemail. - Troubleshooting: add "Users appear without a display name or email", with the cause and fix above.
- Cross-link to SCIM provisioning's "Create groups from user attributes" and "Label derived groups", noting that
departmentandcostCenterneed the same mappings to produce groups and AI Gateway attribution labels.
Additional context
Code and design references in stacklok/stacklok-enterprise-platform: enterprise/toolhive-enterprise/docs/design/okta-directory-reconciler.md ("Profile translation"; userName comes from profile.login because "the observed application profile does not expose a userName destination"). Found while walking through demo flows on the demo cluster, which uses the pull reconciler. Standing environments use push SCIM from a SCIM app and don't show the problem.
Fully or partially written by an AI agent.
- 主要语言
- JavaScript
- 星标
- 4
- 派生
- 4
- 平均合并
- 17 小时 57 分钟
- 30 天内合并 PR
- 87
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stacklok/docs-website 的其他 Issue
-
documentation enhancement needs-triage
难度 2/5 1-3 小时 新手友好度 84/100
stacklok/docs-website#1285 ·
维护者通常 1 天内回复
-
documentation enhancement needs-triage
难度 2/5 1-3 小时 新手友好度 82/100
stacklok/docs-website#1258 ·
维护者通常 1 天内回复
-
documentation enhancement needs-triage
难度 1/5 1 小时以内 新手友好度 85/100
stacklok/docs-website#1241 ·
维护者通常 1 天内回复
-
bug documentation needs-triage
难度 2/5 1-3 小时 新手友好度 72/100
stacklok/docs-website#1149 · 2 条评论 ·
维护者通常 1 天内回复
-
needs-triage
难度 2/5 1-3 小时 新手友好度 68/100
stacklok/docs-website#1143 ·
维护者通常 1 天内回复
查看 stacklok/docs-website 的全部 Issue
相似的 Issue
-
step.duration reflects only the last retry attempt (HelperStep.run() overwrites startTime)可能已有人在做 @mirao 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
codeceptjs/CodeceptJS#5774 · 1 条评论 ·
维护者通常 2 天内回复
-
Status: Unconfirmed
难度 1/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
AllTheMods/ATM10-Aeronautics#151 ·
维护者通常 4 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
feimacode/open-design-agent-kit#66 ·
维护者通常 1 天内回复