Obtain groups from Org Authorization Server

Questions OAuth/OIDC
1

Hi,

I’m trying to integrate my SPA with Okta. My app will use the user’s groups for internal authorization. I’m trying to use the org authorization server to keep the configuration as simple as possible for my clients. My app uses the auth code flow, and PKCE. I understand that this flow will return ‘thin’ tokens, and I need to call the /userinfo endpoint. However, when I do that, I still don’t get the groups back.

The scopes in my initial login request are “openid email profile offline_access groups”. I’ve confirmed these scopes are reflected in the access token.

My groups filter is ‘matches regex * ’ and I have a group assigned to my app.

Result from /userinfo:

image
image772×502 25.5 KB

Is there any other configuration required to get groups from the org auth server?

Thank you,

John

2

Can you provide a screenshot showing how and where you configured your groups claim?

3

Sure, it’s here:

image
image1563×988 88.1 KB

4

Can you try changing your filter to .* instead of *?

5

Ha, of course that was it! Lost multiple hours to one missing dot :face_exhaling: .

Thanks for your help!

1 Like
6

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.