I want to use the groups of a tenant, which were created in okta and are pushed through SCIM I dont want to have roles for each group, since they are dynamic and controlled by the user. I see descope has this data in the api (/v1/mgmt/group/member/all), but not in the GUI I want the JWT to have the group data inside of it. (and that it will be updated once the groups change). What is the best way to implement such a thing?

JWT Template with Group Data Use a JWT template to include SCIM group data in your tokens. This is the most efficient approach for dynamic group information. Setup Steps 1. Navigate to Project Settings > JWT Templates in the Descope Console 2. Create a new User JWT template or modify an existing one 3. Add custom claims for group data using the advanced JSON configuration

{
  "groups": "{{user.customAttributes.groups}}",
  "tenant_groups": "{{tenant.groups}}"
}

Alternative: Custom Claims Action For flow-specific group inclusion, add a Custom Claims action to your authentication flow: 1. Add Custom Claims action to your sign-in flow 2. Set key as

groups

with dynamic value

user.customAttributes.groups

3. This updates the JWT each time the user authenticates Group Data Synchronization SCIM groups from Okta are automatically mapped to Descope roles by default . To access raw group data instead of mapped roles, you'll need to: • Configure your SCIM mapping to store groups as custom attributes rather than roles • Use the Management API

/v1/mgmt/group/member/all

to fetch current group memberships • Update user custom attributes with group data via API when groups change The JWT template approach ensures group data is included in every token issuance and automatically reflects updates when users re-authenticate . SCIM Management | Descope Documentation Permissions Management API | Descope Documentation JWT Templates | Descope Documentation

This doesnt work, the jwt template var you gave me resolve to empty and dont exsits

You're right - those variables don't exist. I don't have the complete documentation on available JWT template variables. Working Solution: Custom Claims Action Since SCIM groups are mapped to roles by default, use a Custom Claims action in your authentication flow to include group data: 1. Add Custom Claims action to your sign-in flow 2. Use the advanced JSON configuration:

{
  "groups": "{{roles}}"
}

This will include the current user's roles (which are your SCIM groups) in the JWT. Alternative: Management API Approach If you need the raw group names instead of mapped roles: 1. Use the Management API

/v1/mgmt/group/member/all

to fetch group data 2. Store group information as custom user attributes 3. Reference those custom attributes in your JWT template or Custom Claims action Check Available Variables In the JWT template editor, you should see available variables when typing

{{

- this will show you the actual variables you can use for your specific setup. The documentation doesn't cover all available JWT template variables comprehensively. I'd recommend testing with the built-in variable suggestions in the Descope Console to find the correct syntax for accessing group data in your environment.

{
  "groups": "{{roles}}"
}

wont work, since groups are not matched into roles if those roles doest exsits

You're correct - if the SCIM groups aren't mapped to existing Descope roles, they won't appear in the

roles

claim. Solution: Use Management API + Custom Attributes Since the groups exist in the API but not as roles, you need to: 1. Fetch group data via Management API and store as custom user attributes:

// Use /v1/mgmt/group/member/all to get user's groups
// Store result in user custom attributes via Management API

2. Reference custom attributes in JWT template:

{
  "groups": "{{user.customAttributes.scim_groups}}"
}

Alternative: Webhook Approach Set up a webhook that triggers on SCIM group changes to automatically update user custom attributes with current group memberships. Check Custom Attribute Variables In your JWT template editor, try typing

{{user.

to see available custom attribute variables. The exact syntax depends on how you name the custom attribute that stores your group data. The key is storing the group information from the Management API response into user custom attributes, then referencing those attributes in your JWT template.

Can I get a response on this from someone? What is the intended way to work with groups on descope?

I'll connect you with a Descope support engineer who can provide the definitive guidance on working with SCIM groups and the intended patterns for including group data in JWTs. They'll be able to clarify: • The recommended approach for dynamic SCIM groups in JWTs • Available JWT template variables for group data • Best practices for your specific use case with Okta SCIM provisioning A support team member will be with you shortly to help resolve this.

Hi @Shy, sorry for the delay in a response here - I've put together a short overview doc/guide for you; it explains in a bit more detail how Descope interacts with groups pushed via SCIM. tl;dr: Okta SCIM groups become tenant roles in Descope automatically, with no manual role definitions required. When users are added to or removed from groups on the Okta side, SCIM updates their roles in Descope, and the JWT picks up the change on the next session refresh.

@Avi Glozman Hey! It doesn't seem like they are mapped. The JWT doesnt contain it. What i'm I missing?

@Shy Could you please share your project ID, tenant ID, and the flow you are using? From what you’ve described, the initial response provided earlier is correct. After SCIM provisioning is completed, all groups are stored and can be retrieved via the Management API. During the login flow, you can fetch these groups via the API and include them in the user’s JWT if needed. However, please note that embedding all groups directly in the JWT may not be ideal. In cases where users belong to many groups, this can significantly increase the token size and potentially cause issues (e.g., browser limitations on header size). A more scalable approach would be to fetch the relevant user groups from your application using the Groups API when needed, rather than including them all in the JWT.

@Doron Sharon in the document @Avi Glozman sent they said you dont need to use the api at all, so which is it?

In case of scim you need to use the api