# Return user groups in OIDC access token (Auth0) **URL:** \ **Category:** OAuth/OIDC\ **Created:** [January 2, 2023, 12:02pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924 "2023-01-02T12:02:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![ranmitiga](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@ranmitiga](https://devforum.okta.com/u/ranmitiga)\ **Post date:** [January 2, 2023, 12:02pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/1 "2023-01-02T12:02:38Z")
Hi, I’ve set up an integration between Auth0 and Okta. For some reason, I’m not receiving the user’s groups, even though I’ve set the proper claim. Even when I try `GET /oauth2/v1/userinfo` I only get personal data without the groups. This is the settings: ![Screen Shot 2023-01-02 at 14.01.22](https://global.discourse-cdn.com/oktadev/original/2X/5/5abf0b5fa0ff011234498dcdb3aecf8e7f0621bf.png) What am I missing here? ---
**Author:** ![gpadma](https://avatars.discourse-cdn.com/v4/letter/g/858c86/32.png) [@gpadma](https://devforum.okta.com/u/gpadma)\ **Post date:** [January 3, 2023, 7:43pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/2 "2023-01-03T19:43:37Z")
Hello, Can you make sure you pass the `groups` scope in the request ? If the user is part of AD groups and if you are looking to get AD groups in the groups claim, you might want to use an expression with Group functions such as Groups.contains, Groups.startsWith or Groups.endsWith. Group functions reference [doc](https://developer.okta.com/docs/reference/okta-expression-language/#group-functions). ---
**Author:** ![ranmitiga](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@ranmitiga](https://devforum.okta.com/u/ranmitiga)\ **Post date:** [January 5, 2023, 9:31am UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/3 "2023-01-05T09:31:54Z")
Hey, I’m not really sure that `groups` is being passed in the scope. I configured an `Okta Workforce` in Auth0, and it doesn’t seem like I can modify the scopes. When I try passing a customized authorization endpoint (with `scopes` as a query param) the whole authentication breaks. Can you assist me with the Group functions? not sure what function I’m supposed to use in order to return the user’s group. (also the link you attached sends me to a different page) Thanks! ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [January 9, 2023, 4:15pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/4 "2023-01-09T16:15:41Z")
That expression should, at the very least, return the “Everyone” group, but you may run afoul of groups claim limitations (see this [article](https://support.okta.com/help/s/article/Limitations-of-Group-functions-Dynamic-Whitelists?language=en_US)). If you could be encountering the limit mention there, you should test with an even simpler groups claim that will match against the smallest number of groups possible (for example, ONLY try to match the “Everyone” group to ensure the claim is working). You can check if the `groups` scope is even being requested in the /authorize request by reviewing your System Logs on the Okta side and check the full request URI listed for an authorize request to the app in question. ---
**Author:** ![emagav](https://avatars.discourse-cdn.com/v4/letter/e/3ec8ea/32.png) [@emagav](https://devforum.okta.com/u/emagav)\ **Post date:** [January 12, 2023, 9:21pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/5 "2023-01-12T21:21:02Z")
I had the same problem. My solution was to not use the Okta Workforce connection but use a plain OIDC connection. The setup is almost as easy (you can re-use the same application you already made in Okta) and it allows you to configure scopes. I don’t know why they didn’t include this functionality in Okta Workforce. Once I did that, I had ‘groups’ show up in the user raw JSON ---
**Author:** ![ranmitiga](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@ranmitiga](https://devforum.okta.com/u/ranmitiga)\ **Post date:** [January 16, 2023, 11:54am UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/6 "2023-01-16T11:54:14Z")
Unfortunately the `groups` isn’t being requested, and it seems impossible to include it with the Okta Workforce in Auth0 😕 ---
**Author:** ![ranmitiga](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@ranmitiga](https://devforum.okta.com/u/ranmitiga)\ **Post date:** [January 16, 2023, 11:54am UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/7 "2023-01-16T11:54:58Z")
(post deleted by author) ---
**Author:** ![ranmitiga](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@ranmitiga](https://devforum.okta.com/u/ranmitiga)\ **Post date:** [January 16, 2023, 1:51pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/8 "2023-01-16T13:51:04Z")
Thank you! that worked. For those who fail to get the user’s groups with the Okta Workforce integration, as @emagav mentioned, just configure a manual OIDC instead - this way you can pass your own scopes. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [January 17, 2023, 1:51pm UTC](https://devforum.okta.com/t/return-user-groups-in-oidc-access-token-auth0/22924/9 "2023-01-17T13:51:36Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.