clarify okta claim configuration requirement (#16142)

librenms · Jun 19, 2024 · e48897c · e48897c
1 parent cce0a58
commit e48897c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/doc/Extensions/OAuth-SAML.md b/doc/Extensions/OAuth-SAML.md
@@ -298,6 +298,11 @@ Socialite can specifiy scopes that should be included with in the authentication
 For example, if Okta is configured to expose group information it is possible to use these group
 names to configure User Roles.
 
+This requires configuration in Okta.  You can set the 'Groups claim type' to 'Filter' and supply
+a regex of which groups should be returned which can be mapped below.
+
+![socialite-okta-1](/img/socialite-okta-4.png)
+
 First enable sending the 'groups' claim (along with the normal openid, profile, and email claims).
 Be aware that the scope name must match the claim name. For identity providers where the scope does
 not match (e.g. Keycloak: roles -> groups) you need to configure a custom scope.

diff --git a/doc/img/socialite-okta-4.png b/doc/img/socialite-okta-4.png