AndresS.25555 (Customer) asked a question.
Identity providers routing rules `Dynamically match to an IdP` login object structure
In tab for routing rules in the Identity providers page, when creating a new rule you are offered to use `Dynamically match to an IdP` in the `Use this identity provider` field, and though it's clear that we can use an Okta language expression, it's not clear at all what is the structure of the only object available, `login`. Can you please add this information to the documents or at least add a better validation in this field indicating what are the available attributes in the login object?
Hi @AndresS.25555 (Customer) , Thank you for reaching out to the Okta Community!
I've looked into this and the Admin UI option for expression language reference in the configuration seems to redirect to the General Okta Expression Language documentation which is not helpful in this context as it does not reference the Login context which is covered in the "Expression Language in Identity Engine" documentation.
The way I understand it, is that the current feature allows syntax customization only around the "login.identifier" and which is dependent on the username attribute, so in essence as the default option suggests login.identifier.substringAfter('@') - would check the value after "@" in the username john.smith@domain.com and route to the appropriate IDP based on that.
You might be able to customize the part after "login.identifier." and use a different string function like "contains" for example.
That being said, other user profile attributes are not currently supported.
Please open a case to have the Support team work with the internal team to correct the documentation link offered in the Admin UI, and if needed, please submit a Feature Enhancement Request on the Okta Community page by going to the Community→ Ideas tab. Features suggested in our community are reviewed and can be voted and commented on by other members. High popularity will increase the likelihood of it being picked up by the Product Team and it being implemented.
More details here.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added
Join the discussion for our Ask Me Anything on September 29, 2025: Device Assurance. Ask our expert questions.
This is probably a new feature thats not fully availble. I did some searching myself and couldnt find much in terms of documentation. you may just have to try a few options using expression language. i think the idea is you match something on the username to an IDP name. for example anyone with an email domain of @test.com routes to test IDP