How to add AD groups to users id_token (working example)

Questions OAuth/OIDC
9

Yes, the groupid in the whitelist is ‘00gdkn3mrkSqcE2n00h7’ which is:

{
    "id": "**00gdkn3mrkSqcE2n00h7**",
    "created": "2018-01-09T23:01:06.000Z",
    "lastUpdated": "2018-01-09T23:01:06.000Z",
    "lastMembershipUpdated": "2018-01-09T23:01:06.000Z",
    "objectClass": [
        "okta:windows_security_principal"
    ],
    "type": "APP_GROUP",
    "profile": {
        "name": "Domain Users",
        "description": "CASUPPORT.support2016.ad.hursley.ibm.com/Users/Domain Users",
        "windowsDomainQualifiedName": "CASUPPORT\\Domain Users",
        "groupType": "Security",
        "groupScope": "Global",
        "samAccountName": "Domain Users",
        "objectSid": "S-1-5-21-2369833120-3074229025-114115762-513",
        "externalId": "rTYxz7hheUK3db9G0StWMg==",
        "dn": "CN=Domain Users,CN=Users,DC=CASUPPORT,DC=support2016,DC=ad,DC=hursley,DC=ibm,DC=com"
    },

The userinfo shows only the OKTA group “ADGROUP”:

userinfo: {"sub":"00udkg9wxf0cMv2E50h7","zoneinfo":"America\/Los_Angeles","email_verified":true,"updated_at":1515539206,"name":"TM1 USER",**"groups"**:**["ADGROUP","Everyone"]**,"preferred_username":"tm1@CASUPPORT.support2016.ad.hursley.ibm.com","locale":"en-US","given_name":"TM1","family_name":"USER","email":"tm1@CASUPPORT.support2016.ad.hursley.ibm.com"}