How to Check if a User Is a Member of a Specific Group in Okta Workflows

Administrators require a method to verify if a user belongs to a specific group within Okta Workflows. This how-to guide presents how to check if a user is a member of a specific group in Okta Workflows.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows

How Does a Helper Flow Verify Group Membership?

The following diagram shows a helper flow that checks whether a user belongs to a specific group by taking a User ID and Group name as inputs, retrieving all groups associated with the user, searching the returned list for a matching group name, and returning a boolean result based on whether a match exists.

NOTE:

• The Get Users Groups card shown in the preceding diagram evaluates a maximum of 200 groups due to API pagination limits. If a user belongs to more than 200 groups, the basic flow does not evaluate memberships beyond the initial 200 results. If the list of users in the target group contains fewer than 200 users, consider using the List Group Members card as an alternative.
• For a more advanced alternative that addresses scenarios where a user belongs to more than 200 groups, explore replacing the Get Users Groups card and building out pagination use within Workflows using the starting set of resources at Workflows Collection: Build Flows with Recursion to get the full list of groups for a user.

What Are the Steps to Configure the Helper Flow?

Configure the helper flow to evaluate group membership by adding the required cards in the following sequence.

1. Add the Helper Flow card and configure two inputs: User ID and Group name. These inputs determine whether the specified user is a member of the specified group.
2. Add the Okta – Get Users Groups card and map the User ID input to return all groups associated with the user.
3. Add the List – Find card to search whether the Group name input matches any of the groups in the returned list. Configure the card to search only the Profile.Name path in the group list JavaScript Object Notation (JSON). The item output field represents the first item in the list that meets the specified criteria, and the index output field represents the location of the item in the original list.
4. Add the Branching – Assign If card to check whether the index is greater than zero. If the index is greater than zero, a match exists, and the return is set to true. If the index is less than zero, a match does not exist, and the return is set to false.

What Does the Group List JSON Structure Look Like?

The following JSON sample shows the group list structure that the List – Find card evaluates, including the Profile.Name and Profile.Description fields used to match the Group name input.

{
    "Last Membership Updated": "2023-05-25T18:36:20.000Z",
    "Last Updated": "2022-07-01T14:10:24.000Z",
    "Profile": {
      "Name": "No-code Automation",
      "Description": "A group with awesome people"
    }
    ...
  },
  {
    "Last Membership Updated": "2022-11-17T17:36:33.000Z",
    "Last Updated": "2022-06-24T19:32:06.000Z",
    "Profile": {
      "Name": "No-code Builders",
      "Description": "Folks who build automations"
    }
    ...
  }

What Do Successful and Unsuccessful Flow Executions Look Like?

• The following screenshot shows a flow execution where the group name successfully matches an existing group, resulting in an index value of zero or greater and a returned value of true.

• The following screenshot shows a flow execution where the group name does not match any existing group, resulting in a returned value of false.

NOTE: In the above screenshot, the index in the List – Find card is -1, which indicates no match exists.