I am trying to create a SSO app using SAML authentication with Okta. I have gotten to the stage where the app can successfully authenticate Okta users and access the information in the SAML assertion - groups and user attributes.

Our cloud based app uses an attribute based access control system to define what a user can access and their personal configuration - this is done by an admin and not on a user level. We have UIs in place for an admin who logs into our system to set this up, however we would prefer a method of doing so strictly through Okta or a transitory app that requires an Okta authentication to then populate Okta automatically with the correct configuration.

I am looking for advise on what the best methodology would be to implement such a system into Okta, as a role based system or simply using group names wouldn't be granular enough. The values of permissions are not fixed and vary on a tenant by tenant basis, i.e skill: 423, 532, 323, where these skill ids would only exist for the one tenant and not another.

An ideal system would be where a group would be created in Okta by a transitory system, on the SP side, which would have custom attributes attached to that group that could be retrieved via an API call or the SAML assertion from Okta when a user logs in.

Any help in this would be greatly appreciated.