Okta Certified Administrator · Part II

Application Setup

31% of Part II — the largest hands-on use case.

Application Setup

Task 3: Create and Map a Custom Attribute

3 tasks · this deck covers task 3 of 3 — the last one in this task set

The Task

"Create and map a custom attribute"

Not every value an app needs already lives in Okta as-is. This task is about deriving a new one on the fly, at mapping time, using an expression.

Not the Same as User Management's Custom Attribute Task

User Management's "Custom Attribute on a User Type" was about adding a stored profile field to a specific user type. This task is different: it's about writing an expression that transforms or combines existing attributes during the app mapping itself — the value doesn't need to be pre-stored anywhere.

The Mechanism

Okta Expression Language (a subset of Spring Expression Language) lets you "concatenate attributes, manipulate strings, convert data types, and more" before a value is stored or transmitted.

Example: displayName=lastName,firstName — combining two fields into one on the fly.

The Syntax — Object Prefixes

source — the left-side object, in either mapping direction
user — the Okta user profile (Okta → App mappings only)
appUser — the in-context app profile (App → Okta mappings only)
appUserName — explicitly names a specific app (for cross-app references)

The Gotcha — Expressions Don't Watch Groups

Attribute updates don't automatically trigger when group membership changes.

If an expression's output logically depends on group membership, don't expect it to recompute the moment a user's groups change — it updates on the normal attribute-update trigger, not a group-change trigger.

The Angle — What Trips People Up

Watch for these in your own sandbox run:

→ Using the wrong prefix (user vs appUser) for the mapping direction you're actually working in.

→ Expecting a group-dependent expression to update immediately on a group change — it won't, until the attribute itself updates.

One Line To Remember

Expressions (Okta's SpEL subset) transform or combine attributes at mapping time — concatenation, string manipulation, type conversion. Use `source`/`user`/`appUser`/`appUserName` prefixes correctly for the mapping direction. They don't recompute on group-membership changes, only on normal attribute updates. Distinct from creating a stored user-type attribute (User Management Task 4).

Sources: help.okta.com — usgp-attribute-mappings-expressions.htm

✓ Application Setup — 3 of 3 courses complete (labs still to come)