# Getting Okta claims and attaching it as a custom claim to the Auth0 token

**URL:** <https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683>\
**Category:** Get Help\
**Tags:** oidc-enterprise-connection, connections\
**Created:** [April 27, 2023, 10:18pm UTC](https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683 "2023-04-27T22:18:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![adoami](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@adoami](https://community.auth0.com/u/adoami)\
**Post date:** [April 27, 2023, 10:18pm UTC](https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683/1 "2023-04-27T22:18:21Z")

</div>

I recently created an app that has two methods of logging in: one is Auth0’s passwordless mechanism and the other is using our company’s Okta instance. I’m currently using this [Login Flow](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#add-user-roles-to-id-and-access-tokens) to attach roles to the Auth0 id tokens which works for when we create users in the Auth0 admin console, but I don’t want to do this for our Okta users which already have role information in their user profile.

Ideally, I would use the code provided in the Auth0 docs as a flow and set the roles I find in the okta token in the auth0 idtoken:

```auto
exports.onExecutePostLogin = async (event, api) => {
  const namespace = 'https://my-app.example.com';
  if (event.authorization) {
    if (event.connection == 'okta') {
        */ use okta token to get roles attached to okta user /*
        api.idToken.setCustomClaim(`${namespace}/roles`, {{roles_from_okta}});
        api.accessToken.setCustomClaim(`${namespace}/roles`, {{roles_from_okta}});
    }
    api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
    api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles);
  }
}

```

Is the okta token exposed to this api? I wasn’t able to find this info in the docs.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 27, 2023, 10:59pm UTC](https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683/2 "2023-04-27T22:59:16Z")

</div>

Hey there @adoami welcome to the community!

> [@adoami](#):
>
> Is the okta token exposed to this api?

I don’t believe the token itself is exposed here - If any role data is exposed to Actions, it would be in the [event object](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object), `event.user.identites` array. I am not positive what is exposed for Okta in particular, so it may take some testing on your end. Aside from that, the only other way I can imagine getting that data would be to use some sort http client to reach out to Okta directly from within your Action.

Keep us posted!

---

<div class="post-metadata">

**Author:** ![adoami](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@adoami](https://community.auth0.com/u/adoami)\
**Post date:** [April 28, 2023, 7:21pm UTC](https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683/4 "2023-04-28T19:21:59Z")

</div>

In order to perform a http request, we’d need the Okta access token. Is there a way to get the enterprise access token that is returned from the OIDC flow with Okta from within the action?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 28, 2023, 11:33pm UTC](https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683/5 "2023-04-28T23:33:07Z")

</div>

Hey there @adoami thanks for following up - As far as I’m aware there is no OOTB way to access the user’s access token from within an Action.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 12, 2023, 11:33pm UTC](https://community.auth0.com/t/getting-okta-claims-and-attaching-it-as-a-custom-claim-to-the-auth0-token/105683/6 "2023-05-12T23:33:25Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.