Okta Workforce Enterprise Groups Assigning Roles

Get Help
, ,
3

Hi @iris-technology

Welcome to the Auth0 Community!

You are asking how to correct the Post-Login Action guidance for your Okta Workforce Enterprise connection, so that group information from Okta is available to your Action and is not confused with Auth0 RBAC roles.

Summary: Group membership from Okta reaches Auth0 only when the Okta application sends a groups claim, and Auth0 stores that value as federated_groups on the user, which is separate from the RBAC roles returned in event.authorization.roles.

Root Cause: Auth0 can receive group values from Okta only if the Okta application includes a groups claim in the ID token. When the claim is missing or filtered out, the user record does not contain federated_groups, even though the connection mapping lists it. Group membership and Auth0 RBAC roles are also separate objects, so a role assigned to a group does not automatically appear in event.authorization.roles.

Solution: Confirm that Okta sends the groups claim, then read federated_groups from the user in your Action.

  1. Open the Okta application that connects to Auth0, then select the Sign On tab.
  2. Edit the OpenID Connect ID Token settings, and set the Group Claims Filter to the name groups.
  3. Select the Matches regex option and enter .* to return all groups. If the regex option returns no groups in your Okta organization, change the filter to an expression such as Groups.startsWith("your_prefix", "", 100).
  4. Sign in through the Okta connection again, then check the user's raw JSON in the Auth0 Dashboard for a federated_groups value.
  5. Read the federated_groups value in your Post-Login Action. The value arrives as a string, so split it on the delimiter your Okta filter uses before you compare individual groups.
  6. Map any group that must grant access to an Auth0 role in a separate step, using the Management API call described in the earlier guidance. Federated group values alone do not add RBAC roles.