# Okta Workforce Entreprise SSO Groups Clarification **URL:** \ **Category:** Get Help\ **Tags:** oidc-enterprise-connection, connections\ **Created:** [March 6, 2025, 2:22pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455 "2025-03-06T14:22:51Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 6, 2025, 2:22pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/1 "2025-03-06T14:22:51Z")
### Question Following up on [Okta Workforce Entreprise SSO Groups](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups/106573) – is this still the case? ### Reasoning I ask because I setup an Okta Workforce connection and I select the **User Mapping \> Okta Default** setting I see that `groups` are sent in the scopes and `federated_groups` shows up in the mapping be default: ![image](https://global.discourse-cdn.com/auth0/original/3X/b/7/b779a0616ed924fd06a3da7a820b09460aaa1b1d.png) However, even after the user authenticates through the Okta connection, we don’t see the `federated_groups` on the user in Auth0 (but we do see `federated_locale` and `federated_zoneinfo`). I thought maybe the article meant that _Okta_ isn’t sending the groups claim. I opened [this question](https://devforum.okta.com/t/okta-workforce-connection-does-not-contain-groups/32436) on their forum. Their response seems to indicate that Auth0 is dropping the `groups` on the floor not that Okta isn’t sending. I was hoping to confirm this. ---
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 6, 2025, 2:27pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/2 "2025-03-06T14:27:47Z")
Also, I noticed Auth0’s [documentation](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc#group-claim-mapping) around setting up groups seems like this should be supported. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 6, 2025, 5:45pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/4 "2025-03-06T17:45:32Z")
Hi @davidhouseknechtdev Welcome back to the Auth0 Community! Have you tried using the `bind_all` for the `mapping_mode` attribute? Kind Regards, Nik ---
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 6, 2025, 6:27pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/5 "2025-03-06T18:27:24Z")
Hey @nik.baleca, Yeah, I have tried that. I get this error: ![image](https://global.discourse-cdn.com/auth0/original/3X/b/a/ba5d96a7077902a154a55207b6313336d8e2166d.png) ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 6, 2025, 7:20pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/6 "2025-03-06T19:20:45Z")
I see, that is quite weird. For your Okta Workforce connection, are you using a `front_channel` connection or a `back_channel` channel? And just to confirm, you have configured an OIDC connection or an Okta Workforce Enterprise connection? If it is an Okta Workforce Enterprise Connection, could you please try the following user mapping? ```auto { "attribute_map": { "mapping_mode": "bind_all", "userinfo_scope": "openid email profile groups", "attributes": { "name": "${context.tokenset.name}", "email": "${context.tokenset.email}", "username": "${context.tokenset.preferred_username}", "federated_groups": "${context.userinfo.groups}", "federated_locale": "${context.userinfo.locale}", "federated_zoneinfo": "${context.userinfo.zoneinfo}" } } } ``` Kind Regards, Nik ---
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 6, 2025, 10:47pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/7 "2025-03-06T22:47:26Z")
Thanks @nik.baleca, I was able to save that configuration you listed. I am waiting to hear back from our partner to try the login connection again. I will let you know what comes of that. As far as your other questions: - We have an **Okta Workforce Enterprise connection** setup - I don’t know how to tell if we are using a `front_channel` or a `back_channel` login ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 6, 2025, 11:16pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/8 "2025-03-06T23:16:31Z")
Great! Since you are using Okta Workforce Enterprise connection and not an OIDC one, you do not have the option for front\_channel or back\_channel communication so you can disregard that. Looking forward to your reply! Kind Regards, Nik ---
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 7, 2025, 3:15pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/9 "2025-03-07T15:15:41Z")
Hey @nik.baleca! Our partner was able to try this out last night. Unfortunately, it looks like it didn’t work and even regressed a little bit. We still don’t have the `groups` showing up on the user’s object after authenticating, but now we don’t have the `federated_locale` or `federated_zoneinfo` either. Are there any other steps I could try? ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 7, 2025, 6:20pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/10 "2025-03-07T18:20:18Z")
Hi there, Thanks for the update! I will look further into the issue regarding possible solutions, usually, the groups should be returned as long as the user has assigned groups. You can also try the following mapping: ```auto { "attributes": { "name": "${context.tokenset.name}", "email": "${context.tokenset.email}", "username": "${context.tokenset.preferred_username}", "groups": "${context.userinfo.groups}", "federated_locale": "${context.userinfo.locale}", "federated_groups": "${context.userinfo.groups}", "federated_zoneinfo": "${context.userinfo.zoneinfo}" }, "mapping_mode": "use_map", "userinfo_scope": "openid email profile groups" } ``` Also, under the connection’s settings, do you have the following scopes set? `openid profile email groups` In the meantime, you can implement an OIDC enterprise connection instead of an Okta Workforce one and use the following settings: - Front channel communication with `bind_all` mapping method: this should map the groups as a string - Front channel communication with `use_map` mapping method: this should map the groups as an array When setting up the connection metadata, for the `issuer` attributed you can try using `/oauth2/default/.well-known/openid-configuration` endpoint instead of the `/oauth2/default/` if you are having issues with retrieving the groups. I will come back with an update as soon as possible! Kind Regards, Nik ---
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 10, 2025, 3:54pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/11 "2025-03-10T15:54:58Z")
Thanks @nik.baleca. Yes, we have that mapping already set and the `groups` sent in the scopes. I was hoping to avoid using a standard OIDC or SAML enterprise connection since the Okta Workforce connection doesn’t count against our quota for enterprise connections. I may still give this a shot, though, just to verify. Keep me posted on anything else you all may find and/or other things I can try. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 10, 2025, 4:08pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/12 "2025-03-10T16:08:47Z")
Alright! However, have you tried the proposed mapping above? > You can also try the following mapping: > > ```auto > { > "attributes": { > "name": "${context.tokenset.name}", > "email": "${context.tokenset.email}", > "username": "${context.tokenset.preferred_username}", > "groups": "${context.userinfo.groups}", > "federated_locale": "${context.userinfo.locale}", > "federated_groups": "${context.userinfo.groups}", > "federated_zoneinfo": "${context.userinfo.zoneinfo}" > }, > "mapping_mode": "use_map", > "userinfo_scope": "openid email profile groups" > } > > ``` I will be looking forward to an update. Kind Regrds, Nik ---
**Author:** ![davidhouseknechtdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davidhouseknechtdev/32/12778_2.png) [@davidhouseknechtdev](https://community.auth0.com/u/davidhouseknechtdev)\ **Post date:** [March 11, 2025, 2:14am UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/13 "2025-03-11T02:14:22Z")
Sorry, I should have clarified – we have tried that mapping. It is very similar to the mapping we began with and caused us to report the issue. The only difference between the one you sent and the one we used was this extra line: ```json "groups": "${context.userinfo.groups}" ``` However, that appears to be just a duplicate of what we had: ```json "federated_groups": "${context.userinfo.groups}" ``` ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [March 11, 2025, 8:30pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/14 "2025-03-11T20:30:01Z")
Hi @davidhouseknechtdev Regarding the issue at hand, are the group claims being sent from your Okta application in the token? You can review this documentation from Okta about sending the groups in the token: - [Customize tokens returned from Okta with a groups claim | Okta Developer](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/#add-a-groups-claim-for-the-org-authorization-server) Basically, you would need to go to the Okta application → Sign on tab → OIDC ID Token → Edit → Group Claims Filter → Use the name groups → Select Matches Regex → Type .\* ![image](https://global.discourse-cdn.com/auth0/original/3X/d/d/dda6a5fe6373cc8c266b04143c1cdb4eefefa702.png) This will return the groups in a string not in an array. Let me know if this works. Kind Regards, Nik ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 25, 2025, 8:30pm UTC](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455/15 "2025-03-25T20:30:02Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.