title: How can we screen by user groups from Okta on .NET Core?
body: <p>I'm using ASP.NET Core MVC for a web app and using a policy to screen pages. When I create a requirement, I'm able to find all of the regular claims that come with OpenID Connect (name, ver, iss, aud, iat, etc.) but not groups, even though I've added groups in the OpenID Connect token configuration in Okta.</p>
  
  <p>Startup.cs:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {        
      services.AddAuthorization(options =&gt; {
          options.AddPolicy("ActionPrivilegeRequired", policy =&gt; policy.Requirements.Add(new ActionPrivilegeRequirement()));
      });
  }
  </code></pre>
  
  <p>ActionPrivilegeRequirement.cs:</p>
  
  <pre><code>    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, ActionPrivilegeRequirement requirement)
      {
          var groupMembership = context.User.FindFirst(
              c =&gt; c.Type == "groups").Value;
  
          // ...
          return Task.CompletedTask;
      }
  </code></pre>
  
  <p>What do I need to do to add an Okta user's group membership to the user object's claims?</p>
  
  <hr>
  
  <p><strong>Update</strong>:</p>
  
  <p>I've updated the OpenId middleware to include groups in the scope:</p>
  
  <pre><code>            OpenIdConnectOptions opts = new OpenIdConnectOptions()
              {
                  //...
              };
              opts.Scope.Clear();
              opts.Scope.Add("openid");
              opts.Scope.Add("profile");
              opts.Scope.Add("groups");
  </code></pre>
  
  <p>and confirmed that the server request to [Okta endpoint]/oauth2/v1/token and the client request to /authorize include groups, but still haven't found groups in the claims.</p>