I have two service providers that I am connecting to Okta in order to manage identities externally. Can you think of a way to configure Okta to accomplish the following:
- Associate attributes with groups, rather than directly to users. Users within groups would then inherit these attributes.
- Associate groups with applications, rather than directly associating users with applications.
My end goal is to be able to leverage Okta for managing a role store for each service provider. I would expect SAML assertions coming from Okta to be able to be mapped into assertions for individual service providers, based on a permission scheme that the service provider determines.
For 1), you cannot directly associate attributes with groups. But there might be a round-about approach here.
You can have users as members of groups. In the profile editor where you define the attribute mappings, use conditions based on group functions to set attribute values accordingly. See here - http://developer.okta.com/docs/api/getting_started/okta_expression_lang.html for more details on the expression language we support from within the product.
Another approach is to use our API to set the user attributes - having the logic implemented outside of Okta.
2) You can associate apps with groups by using the "manage apps" option under the group object. In doing so, app assignments are then tied to group membership rather than through direct assignments.
来源：https://stackoverflow.com/questions/34072908/okta-group-attributes