Group Rule with AND and OR Operators Evaluations
Last Updated:
Overview
The following Okta Expression Language (OEL) expression does not evaluate as expected when used in a Group Rule:user.department=='Test Workforce' or user.department=='Another Test Workforce' AND user.employeeType=='TheBest'
A user with an employeeType of TheBest passes the rule evaluation, even when other conditions are not met.
Applies To
- Okta Expression Language (OEL)
- Group Rules
- User Lifecycle Management
Cause
The AND operator has a higher precedence than the OR operator and is evaluated first. The expression from the Overview is evaluated as if it were written with the following parentheses:user.department=='Test Workforce' OR (user.department=='Another Test Workforce' AND user.employee_type=='TheBest')
This logic allows a user who is in the Test Workforce department (regardless of employee type) OR a user who is in the Another Test Workforce department AND is the TheBest employee type.
Solution
To ensure the conditions are evaluated in the correct order, use parentheses to group the OR conditions together.
The corrected expression is:
(user.department=='Test Workforce' or user.department=='Another Test Workforce') AND user.employee_type=='TheBest'
This expression translates to: The user must be in the Test Workforce department OR the Another Test Workforce department, AND the user must also be the TheBest employee type. This logic ensures only users with the TheBest employee type from either specified department passes the rule.
