Exceed the 100 Groups Limitation on an Okta Group Claim When Using the Implicit Flow

Okta limits group claims to 100 groups when using the Implicit flow. Administrators can bypass this limitation by creating a static allowlist within the application profile and updating the group claim to use the getFilteredGroups function. Existing group expressions, such as Groups.contains and Groups.startsWith, only return up to 100 groups. Combining these expressions still limits the population to 100 groups within a group claim.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Applications Authenticating Using the Implicit Flow
• Org Authorization Servers for an ID Token or Userinfo Group Claim
• Custom Authorization Servers for ID, Userinfo, or Access Token Group Claims

How do administrators exceed the 100 groups limitation on a group claim?

Create a static allowlist within the application profile and update the group claim to use the getFilteredGroups function:

1. Create a static allowlist within the application profile.
2. Update the group claim to use the following expression:

   getFilteredGroups(app.profile.group_allow_list, "group.name", 2147483647)

This example assumes the static allowlist is named group_allow_list. Administrators must manually manage and update the group_allow_list when group changes occur, such as adding group IDs for new groups that fall under the list. The third argument is the signed integer maximum value (2147483647), which represents the absolute largest number of groups included.

What constraints exist when exceeding the group limitation?

Administrators may encounter specific constraints before reaching the maximum integer value.

• The maximum size of an application profile section when hardcoding all group IDs.
• The maximum size Okta returns for an id_token.
• The maximum size Okta returns for /userinfo.

NOTE: Org authorization servers will include the group claim to the ID token or the Userinfo response. Custom authorization servers can include the group claim in either an access token or an ID token.