I use a routing rule but I opted for Domain list on login and just listed the domains I wanted to route to the corresponding IDP.

AND User matches

Domain list on login

foo.com bar.com etc

I'm not sure how many domains you need to route but this should work for you.

You can also use the User Attribute matching instead of domain in list.

Hi Joe,

Thank you for responding. looking at that option, the challenge i have is that we have production users in foo.com that use IDP 1 but we also have test users in OKTA that also use foo.com. So our production users would need to authenticate to IDP1 but our test users need to authenticate directly to OKTA. i am having some success by creating two rules Rule 1 - Check the user attribute userType equals Test User then route to OKTA for authentication. Rule 2 - domain @foo.com goes to IDP1.

Trying to see how we would avoid having to populate the userType attribute for our test users by somehow using Redgex on login to detect if the user belongs to a IDP if yes the route to IDP1.

Makes sense.

Another way around it would be for all your test users to go to https://yourorg.okta.com/login/default and it will bypass routing rules. This may not be feasible if an app is routing to Okta for auth.

A third way would just be to change the usernames of test users. I've used this approach for a small group of test accounts and just setting the primary email to an email of a 'belly button' user.

I played around with trying with regex and was not successful in the ability to determine IdP. This may be a question for professional services.