Legacy Group claim issue -Implicit Flow

Questions OAuth/OIDC
1

Hi team,

We have a group claims issue for OIDC app-Implicit Flow, when Okta is not generating token if user’s group claim exceeds 100.

Legacy Group claim we are using:

image
image1194×560 31.3 KB

The Okta solution page ( Okta Support Center (Lightning) ) suggests we split the tokens, but for that we need to use Token claims. We tested that with this expression: user.getGroups({‘group.type’: {‘OKTA_GROUP’}}, {‘group.profile.name’: {‘dcms’}}).![profile.name].

Now it turns out we can’t use the exact regex with the new tokens: Okta Support Center (Lightning)

Is there any way we can still use the regex (which is non-negotaible) and overcome the group number limitation?

Also we don’t have any group claims in auth server if that’s of any help.

Appreciate the support!

2

The only way to exceed this limit and still use regex is if you use Authorization Code flow (as mentioned in the article) instead of Implicit flow. It’s also a more secure flow and is recommended over implicit

3

Thanks @andrea , a follow up question. If we continue with the current implicit flow can we create the new tokens instead and just use StarsWith function to filter groups?

Something like:

image
image1006×382 26.2 KB

Can doing this send more than 100groups in claim and allow successful authentication?