This article presents how to send Governance Entitlements as attributes in the SAML assertion.  

• Governance Entitlements
• Okta Identity Governance
• Single Sign-On (SSO)
• SAML Attributes/Assertion

Before starting

• Ensure that Governance is enabled for the SAML application.
  • Navigate to the General Tab > Identity Governance > Governance Engine.
  • A new tab labeled "Governance" will become available for the SAML application. 
• Ensure that Entitlements are already created.
  • The Create entitlements Help Doc provides steps on how to configure Entitlements for the application.
  • If assistance is needed with creating the Entitlements themselves, please open a case with Okta Support and set the Product Type to Okta Identity Governance. 

Steps

1. On the Sign-On tab for the application, there should be a section labeled SAML Attributes.

1. • If this section does not exist, please reach out to Okta Support. 
2. Click on Add Expression.
   1. Provide the Name. 
      • The name used should match the name that the downstream application is expecting (case-sensitive). 
      • For Example, if the application is expecting "Test", set the Name to "Test".
   2. Provide the Expression.
      • The following Okta Expression Language is to be used to make sure the call to the correct profile is made:
        • appuser.entitlements.$attribute
        • Replace $attribute with the Variable Name used for the created Entitlement(s). 
   3. Hit Save.

Entitlements will now be sent to the downstream applications as part of the SAML assertion. 

Related References

• Federated Claims with Entitlements