How to Send Comma Separated Group Roles in SAML Attribute Statements
Nov 25, 2025
Single Sign-On
Okta Classic Engine
Okta Identity Engine
Overview
For some service providers, it may be required to send multiple group values in attribute statements in Okta Integration Network (OIN) or custom Security Assertion Markup Language (SAML) applications. Here is how to send multiple group "roles" values separated by a comma in the SAML statement of an OIN or custom SAML application.
Applies To
- Security Assertion Markup Language (SAML) Application
- Custom attribute statements that require multiple values
- Okta Integration Network (OIN)
Solution
To send multiple values in an attribute statement (such as but not limited to groups), use the following custom expression language syntax:
String.join(",",getFilteredGroups({"00g0wrwggBJr0QpUe000","00ga1i1hzgjbrczcL111","00g22i2ocdPTVPN2d222","00g3wvda3YwskVZh333","00g4gu9dghwizEdJ4444"}, "group.name", 100))
- The IDs (such as
00g0wrwggBJr0QpUe000) are the group IDs that need to be replaced with the values found in the URL of the group that should be sent. Okta group IDs always start with "00g".
