Hi,
We’re integrating Entra ID → Okta (SAML IdP) → OIDC web app for a multi-tenant SaaS app.
Setup:
- Inbound SAML IdP with JIT (create user on first login)
- IdP Group Assignments = Add user to missing groups (Entra sends group Object IDs in SAML)
- Group Rules map customer AD groups → Okta tenant and role groups
- OIDC app is assigned to tenant groups (one tenant group per customer)
- App needs tenant / role / site in the ID token
Problem:
On first login for a new JIT user, Okta creates the user and syncs the Entra AD group, but we get app.generic.unauth_app_access_attempt FAILURE before any OAuth token is issued. Tenant/role groups and app membership are added milliseconds later (Group Rules). User has to log in a second time — then authorize + token grant succeed and the ID token is fine.
We can’t use Full sync of groups because it removes users from our Okta-managed tenant/role groups that aren’t in the SAML assertion.
Log sequence (first session, same root_session_id):
user.lifecycle.create SUCCESS (JIT)
group.user_membership.add SUCCESS (customer AD group from Group Sync)
user.authentication.auth_via_IDP SUCCESS (JIT provisioned new user)
app.generic.unauth_app_access_attempt FAILURE ← blocked here
group.user_membership.add SUCCESS (tenant group — Group Rule)
group.user_membership.add SUCCESS (role group — Group Rule)
application.user_membership.add SUCCESS (OIDC app)
No app.oauth2.as.authorize.code or token grant in that session. Second login ~9s later — all SUCCESS.
Question:
What’s the recommended way to fix this ordering so first login works?
- Assign tenant group at IdP JIT (Assign to specific groups) while still syncing Entra AD groups?
- Run Group Rules synchronously before app authorization?
- Use Auth Server expression claims from a JIT profile attribute (e.g.
customerGroupIds) instead of Okta group membership? - OIDC Token Inline Hook?
- Can this be address through workflow ?
We know there’s no JIT inline hook on inbound SAML provisioning (this thread) — looking for the supported pattern for this timing gap.
Thanks!