This article discusses the limitations of the following Group functions that can be used in Okta Expression Language to configure groups claims: Groups.contains, Groups.endsWith, and Groups.startsWith.

• Group functions
• Dynamic Allowlists
• Okta Classic Engine

Group Functions can be used when configuring a groups claim (either in the ID or Access Tokens) to list the groups of which the user being issued a token is a member.

There are three Group functions that help in using the dynamic group allowlists: contains, startsWith, and endWith. For more details, please check the Group functions documentation. All three of these functions have the following parameters: 
 

However, below will be discussed a few known limitations:

• If a group function is passed a limit parameter value of more than 100:
  • Tokens will not be issued to the user.
  • An error: The 'groups' user claim could not be evaluated. will be returned to the requesting application provided redirect_uri.
    • Example: http://localhost:8080/#state=1234&error=server_error&error_description=%3DThe+%27groups%27+user+claim+could+not+be+evaluated.
  • A user_claim_evaluation_failure error will be logged in System Log.

• For Active Directory Groups, Group name matching is based only on cn.

Related References

• Error: "The groups claim matched too many groups and must be configured to match fewer groups"
• Customize tokens returned from Okta with a dynamic allowlist
• Group-claims only functions