Help for ASP.Net Core 8.0 Blazor/User AD Group claims from Okta using Okta.AspNetCore 4.6.1

Is there any trick to getting user’s groups from Okta? EVERYTHING works perfectly except I can’t get that group that I as a test user am supposed to belong to.

My administrator added a groups claim type of Expression
groups & startsWith('active_directory", “ABC_”, 100)

My Blazor app is almost completely using the Blazor Server side demo on Okta’s code repo found here…

The AddOktaMvc part looks like this…
.AddOktaMvc(new OktaMvcOptions
{
GetClaimsFromUserInfoEndpoint = true,
OktaDomain = OktaConfig.OktaDomain,
ClientId = OktaConfig.ClientId,
ClientSecret = OktaConfig.ClientSecret,
AuthorizationServerId = OktaConfig.AuthorizationServerId,
Scope = [“openid”, “profile”, “email”, “groups”],
});

My C# HttpContext.User.Identity.Claims…
I get 19 claims. None of them are groups.

Hello there, my name is Akash and I will be assisting you with your queries.

If the group information (claim) of the user is not included in the token, then probably NULL value was returned by the expression. This could be due to the user is not a member of a group that matches the substring, and the claim will be eventually absent from the token.

You can test the expression using the Token Preview feature that you can find inside the Authorization Server - Test your authorization server configuration | Okta

You can also write an expression that is in this conditional-based format so that it can handle the case where the user is not a member of a group matching one (or both) of the Groups.startsWith expressions. - Okta Help Center (Lightning)

Also, could you provide me with the exact expression that is added in the claim?

Please make sure to follow this format for the expression - Groups.startsWith(app_type/app_instance_id, pattern, limit)

The expression that you have provided is incorrect - groups & startsWith('active_directory", “ABC_”, 100)

Learn more here - Okta Expression Language overview guide | Okta Developer

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.