I’m building a custom app integration that I plan on submitting to the OIN. I was running the SCIM CRUD tests (https://developer.okta.com/standards/SCIM/SCIMFiles/Okta-SCIM-20-CRUD-Test.json) on Runscope and I discovered a bug when a user is deactivated, then reactivated and reassigned to an app integration.
It only happens when the app has the SCIM provisioning option “Push Profile Updates” enabled.
When a user is re-activated and quickly re-assigned to an Okta app, Okta pushes a reactivation event and a profile update event to the SCIM server. The first event contains “active: true” but the second event contains “active: false” even though the user was reassigned to the app.
I believe there is a database replication issue because if I wait a while before reassigning the user to the app after reactivating them, the profile update event will have “active: true”.
This is problematic because the profile update event is fired after the reactivation event, so the end state of the user in the SCIM app is deactivated even though they are reactivated in Okta.