JoeL.04696 (Customer) asked a question.
Hi all, I'm attempting to retrieve both OpenLDAP and Okta groups in OpenID Connect claims similar to what is documented here for Active Directory: https://support.okta.com/help/s/article/Can-we-retrieve-both-Active-Directory-and-Okta-groups-in-OpenID-Connect-claims?language=en_US As described in that link, the expression to merge Active Directory groups with Okta groups is: Arrays.isEmpty(Arrays.toCsvString(Groups.startsWith("active_directory","",100))) ? Groups.startsWith("OKTA","",100) : Arrays.flatten(Groups.startsWith("OKTA","",100),Groups.startsWith("active_directory","",100)) I can't work out what the equivalent "active_directory" string is to get this working with my OpenLDAP groups. Has anyone done this and got it working? Thanks, Joe
Hi @JoeL.04696 (Customer) , Thanks for reaching out to the Okta Community!
If I'm reading that article right, the "active_directory" string is the generic variable name, so if you want to adapt that to your LDAP, you need to get the value from your Okta Admin Dashboard→ Directory→ Profile Editor→ (insert you LDAP directory name) .
On the LDAP's Profile page, you should see the variable's name. For example in my case (see attached screenshot), I have "ldap_sun_one".
Hope it helps!
Hi @Mihai Negoita - Okta (Okta, Inc.), thank you for your help.
You clearly have done a far better job of interpreting the https://support.okta.com/help/s/article/Can-we-retrieve-both-Active-Directory-and-Okta-groups-in-OpenID-Connect-claims?language=en_US article than I did 😊
You're correct, having tested I am able to confirm that the "active_directory" string in the article does refer to the Variable name as shown in your screenshot. In my case I also have "ldap_sun_one" for this value in my OpenLDAP directory integration and configuring an expression that looks like this:
Arrays.isEmpty(Arrays.toCsvString(Groups.startsWith("ldap_sun_one","",100))) ? Groups.startsWith("OKTA","",100) : Arrays.flatten(Groups.startsWith("OKTA","",100),Groups.startsWith("ldap_sun_one","",100))
..worked as I hoped it would with my OpenLDAP groups.
Thank you again for your help, very much appreciated, Joe