Okta Groups Claim Fails to Return Active Directory Groups
Last Updated:
Overview
When an application or authorization server returns a Groups claim, the claim fails to include the full list of groups for users belonging to Active Directory or other imported application groups. This occurs because the Groups filter claim type only matches Okta-local groups. Configuring a Groups expression instead of a filter resolves the issue and allows Okta to return the external groups.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) / OAuth 2.0 applications
- Org Authorization Server
- Custom Authorization Server
- Active Directory (AD)
Cause
This issue occurs because the Groups filter claim type only matches groups created locally within Okta. The filter claim type fails to match against any application groups or Active Directory groups, even when using the Matches Regex filter.
Solution
How are Active Directory groups returned in a Groups claim?
If the application requires external groups, configure a Groups expression instead of a filter.
Configure the Groups expression on the Org Authorization Server by selecting the Expression option and entering the appropriate Okta Expression Language statement, as demonstrated in the following image.
Configure the Groups expression on a Custom Authorization Server by selecting the Expression option and entering the appropriate Okta Expression Language statement, as demonstrated in the following image.
What are examples of Groups expressions for external applications?
Use the following Okta Expression Language examples to retrieve groups from Active Directory or other external applications.
- To retrieve all Active Directory groups assigned to the user, use the following expression:
Groups.startsWith("active_directory","",100)
- To retrieve only the Active Directory groups that start with a specific substring, such as "Admin_", modify the second argument in the expression:
Groups.startsWith("active_directory","Admin_",100)
- To retrieve groups from another application, change the first argument to match the application variable name. For example, use the following expression to retrieve Google groups:
Groups.startsWith("google","",100)
