Groups with Duplicate Names

Questions API
1

According to documentation, Okta group names are unique. We’ve found that this enforced when adding groups through the Okta Admin UI, and also when we manually create groups via the Groups API (e.g. via Postman or whatnot).

However, we have an application which uses the Okta API to create groups. In our lower (non-prod) environments, this application communicates with an Okta Preview org. We run nightly automation tests against the application which results in multiple calls to create Groups in Okta, with auto-generated names.

We’ve begun getting error responses indicating that our Create Group calls are failing because a group with the same name already exists. When we went and looked at our groups in the Okta Admin UI we found the group name in question WAS already in use. But it was in use for multiple groups. In some cases, up to 4 groups had the same identical name (and we verified that there were no leading/trailing/internal whitespace differences).

We’re working to reproduce the issue. But wanted to reach out and see whether folks had any idea how we could have managed to create groups with duplicate names. Up until recently, we’d also been employing Workflows to create groups, so we thought perhaps there was some conflict between those workflows and our API calls. But since Workflows, in the end, simply call the API themselves, we couldn’t come up with any reasonable way that would be the culprit.

So my question is has the issue of creating duplicate groups been raised before?
Any ideas what we could be doing to cause it?

Attached image is an example from the Groups page showing two groups with identical names.
(The long wonky names are due in part to the fact that they’re auto-generated by automation tests.)

image
image1035×458 30.9 KB

2

Hello,
Currently I do not know of any existing issues that would result in this happening.

If I had to guess a possible cause I might think that a random name is generated, but multiple concurrent requests are then made to create the same group. Since the group has yet to be created/propagated in Okta, it could be possible where multiple requests for the same name are honored. I have never tested this however. Is there a chance in your application more the 1 thread/process could try to create a common randomly generated group name?

If this does not seem like a possibility with your application I suggest opening a support case so you can supply group names and your Org. Support can then look when those groups were created and see if that explains how this happened.

1 Like
3

Thanks for the reply, erik
The application itself wouldn’t be making duplicate requests to create the same group, but it’s possible the application was making a request to create a group and a triggered workflow was attempting to create the same group at about the same time.

So, this seems to indicate that group-name uniqueness is NOT enforced in the Org data layer (e.g. by disallowing duplicate values in the data store), but only in the application layer. Is that true?

4

UPDATE
We wrote a little test program that does nothing more than call the Create Groups API multiple times, with the same group name.
With it, we’ve manage to consistently create multiple groups with the same name.

5

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.