JamesW.95378 (Customer) asked a question.
https://developer.okta.com/docs/reference/okta-expression-language/*group-functions gives an example of getFilteredGroups as getFilteredGroups({"00gml2xHE3RYRx7cM0g3"}, "group.name", 40) but does not tell me what that ID is, why it's in french brackets, whether group.name is a filter, substring, or exact match, nor to what 40 refers. It does tell me that an Array comes back, so that hints that group.name must not be an exact match of the group name or it would only return an Array of one element.
I'd like to get a list of our splunk groups from LDAP so I can make a SAML attribute assertion like:
getFilteredGroups(...something...).Groups.startsWith("splunk-role-").toCsvString.replace("splunk-role-", "").replace(",",";")
... but I'm not sure what incantation can be used there.
Ok so I found https://developer.okta.com/docs/guides/customize-tokens-returned-from-okta/static-whitelist/#use-group-functions-for-static-group-whitelists which says the first argument to
getFilteredGroups is an allowed list of groups by id which makes it pretty useless for matching new groups.
So much for that.