Hi,

I am trying to get groups assigned to an OpenID Connect app included in the access token.

I have followed the okta how-to at https://developer.okta.com/docs/how-to/creating-token-with-groups-claim/*step-three-configure-a-custom-claim-for-your-groups-custom-authorization-server 

As per the guide I have:

1. created a OpenID Connect test app "MarkusTest11"
2. created a new group "MarkusGroup"
3. added the "MarkusTest11" app to the "MarkusGroup"
4. created a new Custom Authentication Server
5. added a whitelist "groupswhitelist" containing the group's "MarkusGroup" to the app profile (note: I tried to add by both name and id, only by id and only by name)
6. added a claim "groupwhitelist" (any scope) to verify the "groupswhitelist" attribute has been added correctly to the app profile and is accessible. Expression: app.profile.groupswhitelist
7. added a claim "groups" (any scope) to my custom OAuth2 authorization server with Expression filter: getFilteredGroups(app.profile.groupswhitelist, "group.name", 10)

When using the Okta Token Preview page of my Custom Authentication Server and using Client Credentials auth I see that the "groupwhitelist" claim is processed correctly and the "groupswhitelist" list attribute of the app profile is returned correctly.

However the "groups" claim is not set on the access token.

Any idea why this is not working? Is there anything I am missing?

Thank you,

Markus