Sending Secure Assertion Markup Language (SAML) attributes using a custom AppUser attribute with the Group attribute type prevents violating the Attribute Statement Character Limit. This method allows the Value field to be populated with a variable referencing the application profile, while the actual mapped value is populated at the group level without relying on the Okta User Profile.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Secure Assertion Markup Language (SAML) 2.0

How is a SAML attribute sent using a custom AppUser attribute with a Group attribute type?

Create a custom application user attribute, configure the SAML settings to reference the new attribute, and assign the desired value to a group.

1. Navigate to Directory > Profile Editor > Users, and select the application name.
2. Select + Add Attribute.

3. Select the desired Data type. The string data type is for one value, while the string array is for multiple values.
    
4. Enter the desired Display name and Variable name.
    
5. ((Optional) Select Define enumerated list of values to allow the selection of pre-populated attributes. Without this option, the attribute must be populated manually.
    
6. Set the attribute type to Group.
    
7. Navigate to the application General tab, and select SAML Settings > Edit > Next (General Settings) > SAML Settings > Show Advanced Settings.
    
8. Add an attribute statement. In this example, role is the attribute name sent in the SAML Response, and appuser.role is the variable sent for the attribute value based on the configuration in the subsequent steps. The appuser variable references the application user profile for this specific application, and role references the custom attribute created in the previous steps.
    
9. Navigate to the Assignments tab, and assign a group by selecting Assign > Assign to Groups. Search for the desired group, and select Assign.
    
    
10. Enter the desired value to be sent as the attribute value for the group.

11. Test the login and check the SAML Response to ensure Okta sends the expected attribute name and attribute value.

<saml2:Attribute Name="role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" > <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string" >Admin</saml2:AttributeValue>

Related References 

• Sending SAML attribute based on AppUser attribute using Personal attribute type