z7orx (z7orx) asked a question.
Workaround for limitations on group functions in claims
Is there a workaround for the limit of 100 groups in group functions with Custom Auth Server?
Presently when we add a group claim with a group function Groups.contains("ldap","okta",100), If there are more than 100 groups that match this filter, an error is returned.
I am seeking a solution where we can change the behaviour to return a string like "too many groups" /omit the claim altogether, instead of user facing an error. Will this be possible via Token Inline hook or may be a simple filter?
I have tried using the filter as below:
Array.size(Groups.contains("ldap", "okta",11))>11? "Too Many Groups": Groups.contains("ldap", "okta",11)
But this does not seem to work.
Any ideas?
Hello Susmita,
The only way around this limitation is to create a filter that doesn't return more than 100 groups
https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned
Be aware of the following before you work with scope-dependent claims:
Best Regards,
Dan