Okta Access Gateway Group Regex Rule Fails and Denies Access
Last Updated:
Overview
Okta Access Gateway (OAG) denies access when a group regex rule references an incorrect attribute name. Updating the protected rule to use the correct mapped attribute name resolves the issue. The following screenshot shows an issue in which users experience a sign-in failure after an administrator configures a group rule to allow access for the Everyone group.
Review the group rule configuration that attempts to grant access to the Everyone group.
Observe the error message Okta generates indicating that access to the application is denied.
Access to resource '/' in application '<app name>' has been denied.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Access Gateway (OAG)
- Protected Rule
Cause
The application attributes map the Groups value to a different name. The protected rule must refer to the specific name defined for OAG. In this scenario, the Identity Provider (IdP) maps Groups to sampleheader.
Review the application attributes configuration showing the Groups attribute mapped to the sampleheader value.
Solution
How is the group regex rule corrected to allow access?
Modify the protected rule by replacing the default group attribute with the specific mapped value defined in OAG to restore application access.
- Navigate to the protected rule configuration in OAG.
- Replace Groups with the mapped value, such as sampleheader.
Verify the updated protected rule configuration displays the correct mapped attribute name.
