How do I access okta groups from a federated Okta in mappings?

Questions
1

I have a application Okta and as an IdP (Social) I have our corporate Okta lined to it. This works just fine. But I would like to be able to access the groups of the user from the corporate Okta from the appliation okta and can’t find information about how to access this.
I added the scope groups - the same wy I have my application access the groups.
I would have expected the mappings to allow access to the returned groups - but I can’t guess the expression. What is the correct expression to access the groups from a federated okta?

And is there a way of seeing what the federated IdP is returning?

2

If I understand your setup correctly.
You have your application in an Okta tenant, then you have your corporate tenant which is an IdP?

So in total you are using 2 Okta tenants?

3

For now yes.
We have a web application that internal users (employees) will use. These users will use our existing company Okta as a federated IdP.
In the next stage, we’re planning to let customers use their own IdPs too.
I’m trying to allow the IdPs pass privilege level information to the application.

4

Normally when configuring another Okta tenant as IdP it will map a user in your other Okta tenant, you have the ability to also push group memberships to your own Okta tenant. (check security -> identity providers -> advanced settings). This has a disadvantage that it can only handle memberships and not create actual groups. This also assumes that the IdP (Okta) sends group membership back in it’s claims.

If the group already exists it will put that user in your Okta group which you can access from the universal directory later on.

I know IdP uses idpuser.attribute to access incoming federated users, not sure if this expression is also available from the app mappings.

5

Is there a way to see what attributes are available in the profile mappings dialog?

6

From IdP into your okta org? Yes! also under security -> identity providers -> edit profile and mappings
https://gyazo.com/aefa2ab9b25c80c0231d8f7dd50b0802

7

But what is the expression to get the groups that Okta returns?