Does "Application username format" apply to users assigned by group membership?

Questions SAML
1

I have an application setup in Okta to SSO my users into SalesForce. My usernames are not the same as the usernames in salesforce, but we have that username available in another field. We have a custom credential defined in the app that uses this other property. But, the custom credential doesn’t seem to apply to users that are assigned to the application by group membership. When those users SSO, its just sending the original username over, not the custom username.

2

Update 1:
I’m wondering if this is not specifically a group membership issue. I tried adding couple of other users to the group, and one out of 5 actually set the custom username format correctly. The rest did not. From the application UI in the admin console, from the list of users assigned to the app, if I click one of the users that is not using the custom username format, I get a modal that pops up containing the current application username, and a ‘reset’ link. If I click the rest link, it changes the username to what should be set by the custom credential format. But when I save, it does not save. I thought maybe there was a conflict with another user containing that name. I made up a totally new name for a new user, added them to my group , went and looked at the app assignments, still didn’t apply the custom credential for that user either.

3

Hello,

Is the custom credential a custom attribute you configured for the application?
If so is it defined as a user attribute or group attribute?

4

Its not actually a custom attribute, its just the primary email address. We dont use email address formatted usernames. We migrated over to Okta with a userbase of nearly a million users that were not using email as username so we were allows to relax the email formatted username requirement. But the system we’re attempting to send these users into requires email formatted usernames. I’m currently just working in qa, so we’re attempting to use a derived username of email + “.qa”. For future reference though, there are custom attributes at the group level? I dont have 100% full admin access to my preview environment so I dont always know what is and isn’t available to me.