Hi!

I'm struggling with following issue:

I'm having OKTA as IdP that allows me to login into AWS via AWS Single Sign-On app and later AWS SSO service.

My OKTA users can belong to multiple (OKTA) groups and I need User membership in groups value to create ABAC at AWS.

But if/when the regex Group Attribute Statements returns multiple values, the SAML formats it like:

<saml:Attribute Name="memberOf" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">

    <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">ProjectX</saml:AttributeValue>

    <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">ProjectY</saml:AttributeValue>

    <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">ProjectZ</saml:AttributeValue>

</saml:Attribute>

Such format is not supported by AWS implementation of SAML as it has to get single value, like:

<saml2:Attribute Name="memberOf" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">

     <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">ProjectX,ProjectY,ProjectZ</saml2:AttributeValue>

</saml2:Attribute>

Does anyone know how the format can be changed? Should I use some tweaked regex? OR instead of Group Attribute, is there a way to do it over User attributes with OEL?

Thanks in advance for any piece of advice.

W.