Troubleshooting Provisioning Errors

Okta Provisioning References Stale User IDs After Directory Migration or Lifecycle drift

Symptoms

• Okta sends provisioning requests including references to users that no longer exist in Seeq

• Group membership assignments fails

Root Cause

This issue occurs when an Okta application is reconfigured to provision to a new Seeq directory without clearing cached object references from the previous directory. It can also happen when users are manually deleted in Seeq in a SCIM-controlled directory.

Specifically:

1. SCIM provisioning was originally configured to provision users and groups to an older Seeq directory

2. Provisioning to the old directory did not complete successfully

3. A new SSO directory was created in Seeq

4. The same Okta application was reused to provision users and groups to the new directory

5. The Okta application retained old Seeq object IDs (e.g., 0EF451B5-23F0-64F0-BF1C-9E7F46AE4A97) that referenced user records in the old directory, not the new one

When Okta sends provisioning requests with these outdated IDs, Seeq cannot locate the referenced users, causing provisioning failures.

Resolution

To clear the stale object references and reset provisioning:

• In Okta, navigate to the Seeq application

  • Go to Applications > Applications

  • Select your Seeq application

• Remove all assigned groups

  • Navigate to the Assignments tab

  • Click on “x” of each assigned group to unassign the group

  • This will indirectly unassign all users that were members of those groups

• Allow a full provisioning/deprovisioning cycle to complete

  • Monitor the Okta application's logs

  • Wait until all users, groups, and group memberships have been deprovisioned

  • This process clears the outdated Seeq object IDs stored in the Okta application

• Re-add group assignments

  • Return to the Assignments tab

  • Assign the appropriate groups back to the Seeq application

  • Okta will begin a fresh provisioning cycle with new object references

• Verify successful provisioning

  • In Seeq, navigate to Administration > User and Administration > Groups

  • Confirm that users and groups appear correctly in the target directory

  • Verify that group memberships are accurate

Prevention

When migrating SCIM provisioning to a new Seeq directory:

• Create a new Okta application rather than reusing an existing one

• If reusing an application is necessary, follow the resolution steps above to clear cached references before configuring the new directory

Avoid manually deleting users or groups in a SCIM-controlled directory.