JessicaW.72146 (Customer) asked a question.
This is a surprisingly new requirement for us in a target application. Most of our applications, users are assigned one role or permission set. However, we have a new application we want to enable provisioning for where a user can be assigned to multiple teams and/or projects and they want to control that via Okta. We usually use groups for permission assignment, as I imagine most people do, so that we can have access requests automated by group rules or our request management platform. However, if we did that here with group-based attributes, we'd have to have a group for every possible combination of permissions which would be very excessive.
So my question is, is there a way in the mapping logic to handle something like:
User should be assigned to product A, B, and C as well as teams 1, 2, 3. They are in Okta groups ProductA, ProductB, ProductC and Team1, Team2, and Team3. So we would want to build their "products" attribute value to be "A, B, C" and their "teams" attribute value to be "1, 2, 3". If they are unassigned from group ProductA, their "products" attribute should change to "B, C" and so on and so forth.
Hi @JessicaW.72146 (Customer) , Thank you for reaching out to the Okta Community!
The "Combine values across Groups" is the option you are looking for. You can find it under your Okta Admin Dashboard→ Directories→ Profile Editor→ <app name>→ edit the desired attribute:
https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-combine-values-use.htm
https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-assign-app-group-priority.htm
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope it helps!