Skip to content

Okta: populate user.email when user name is an email address - #14148

Merged
chemamartinez merged 2 commits into
elastic:mainfrom
chemamartinez:24531-username-processing-okta
Jun 5, 2025
Merged

Okta: populate user.email when user name is an email address#14148
chemamartinez merged 2 commits into
elastic:mainfrom
chemamartinez:24531-username-processing-okta

Conversation

@chemamartinez

@chemamartinez chemamartinez commented Jun 4, 2025

Copy link
Copy Markdown
Contributor

Proposed commit message

According to ECS documentation about user fields usage[1]:

- When a system uses an email address as the main identifier, populate
  both user.id and user.email with it.

This change copies the `user.name` field into the `user.email` field to align
with all other integrations where the main user identifier is an email address,
including Entity Analytics Okta.

This should help anyone who wants to correlate email addresses between integrations.

In this case, the user email is not dissected into `user.name@user.domail` as
for the Okta ecosystem, the user part of the email is meaningless by itself. 

[1] https://www.elastic.co/docs/reference/ecs/ecs-user-usage#ecs-user-identifiers

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@chemamartinez chemamartinez self-assigned this Jun 4, 2025
@chemamartinez chemamartinez added enhancement New feature or request Integration:okta Okta Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jun 4, 2025
@chemamartinez
chemamartinez marked this pull request as ready for review June 4, 2025 15:32
@chemamartinez
chemamartinez requested a review from a team as a code owner June 4, 2025 15:32
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

cc @chemamartinez

@chemamartinez
chemamartinez merged commit 75a42f7 into elastic:main Jun 5, 2025
@chemamartinez
chemamartinez deleted the 24531-username-processing-okta branch June 5, 2025 07:48
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package okta - 3.10.0 containing this change is available at https://epr.elastic.co/package/okta/3.10.0/

@andrewkroh andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:okta Okta Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

4 participants