# Saml groups support in okta
**URL:** https://forum.pritunl.com/t/saml-groups-support-in-okta/3765
**Category:** Pritunl VPN
**Created:** [March 31, 2026, 11:03am UTC](https://forum.pritunl.com/t/saml-groups-support-in-okta/3765 "2026-03-31T11:03:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@nicks](https://forum.pritunl.com/u/nicks)
#### Post date: [March 31, 2026, 11:03am UTC](https://forum.pritunl.com/t/saml-groups-support-in-okta/3765/1 "2026-03-31T11:03:46Z")
Hello,
We are trying to setup saml authentication with okta and so far it works ok. However passing of groups it seems not be possible. Looking into the [documentation](https://docs.pritunl.com/docs/okta-zero) it seems that mapping is done from okta attribute to organization in pritunl. However passing on groups is not supported.
I’ve checked the git repo and in this file [user.py](https://github.com/pritunl/pritunl/blob/master/pritunl/user/user.py) it seems we have the group option available for google and azure, but not for okta. Is this correct ? Are we able to pass groups from okta to pritunl as part of the saml authentication ?
---
### Author:  [@zach](https://forum.pritunl.com/u/zach)
#### Post date: [April 1, 2026, 10:33pm UTC](https://forum.pritunl.com/t/saml-groups-support-in-okta/3765/2 "2026-04-01T22:33:47Z")
This can be done with the SAML attribute `groups`. This can be a comma separated list of user groups.
---
### Author:  [@plachkov](https://forum.pritunl.com/u/plachkov)
#### Post date: [April 2, 2026, 11:05am UTC](https://forum.pritunl.com/t/saml-groups-support-in-okta/3765/3 "2026-04-02T11:05:28Z")
@zach Could you please elaborate more on the exact configuration? Is this done on Pritunl or on Okta configuration? Do you match okta groups to pritunl organisations or okta groups are matched to pritunl groups?
---
### Author:  [@zach](https://forum.pritunl.com/u/zach)
#### Post date: [April 2, 2026, 10:50pm UTC](https://forum.pritunl.com/t/saml-groups-support-in-okta/3765/4 "2026-04-02T22:50:52Z")
In Pritunl there is the SAML `org` attribute this can be used to provide a name of an organization that already exists in Pritunl to add that user to. Pritunl also has user groups, these can be set with the SAML `groups` attribute. This is a comma separated list of user groups that will be added to the user.
Pritunl Zero and Pritunl Cloud use only roles. The SAML attribute `roles` will provide a comma separated list of roles to apply to that user.
---
### Author:  [@plachkov](https://forum.pritunl.com/u/plachkov)
#### Post date: [April 6, 2026, 1:30pm UTC](https://forum.pritunl.com/t/saml-groups-support-in-okta/3765/5 "2026-04-06T13:30:00Z")
Thank you. I got it and it worked. For config reference, I’ve added the following expression in okta attributes:
Admin console \> applications \> applications \> ‘name of the saml application: pritunl-vpn’ \> ‘sign on’ tab \> ‘Attribute statements’ field \> ‘Add expression’ button
Name: _groups_
expression: _user.isMemberOf({‘group.id’: ‘the-id-of-the-okta-group’}) ? “name-of-pritunl-group1” : “name-of-pritunl-group2”_
When the user is created in pritunl it is tagged with ‘name-of-pritunl-group1’ if the identity is a member of ‘the-id-of-the-okta-group’ in okta. If the okta identity is not a member of ‘the-id-of-the-okta-group’ in okta, then the created pritunl user is tagged with ‘name-of-pritunl-group2’. Then these pritunl groups can be associated with different servers.
| |
| --- |
| |