@MatthewR3806 

are you able to access the MSP GenAI Buddy?  Please see if the answer helps you.

https://support.pega.com/support-doc/using-pega-genai-knowledge-buddies

https://support.pega.com/support-doc/my-support-portal-home-page  

References:

https://docs.pega.com/bundle/platform-241/page/platform/security/identity-mapping.html

https://docs.pega.com/bundle/platform/page/platform/security/create-oidc-sso-authentication-service-app-studio-creating.html

⚠ This is a GenAI-powered tool. All generated answers require validation against the provided references.

To reference OIDC claim attributes in an operator data transform, you need to use curly braces notation {claimName} around the claim attribute names. This syntax allows you to directly access the claims received from your OIDC provider (Okta in this case).

Here's how to implement this in your AssignOktaAG data transform:

1. Basic Syntax for Referencing Claims
   • To reference any claim, simply enclose its name in curly braces: {claimName}
   • For example, to reference the email claim: {email}
2. Common Property Mappings When configuring your AssignOktaAG data transform (which should be set with "Applies To" class of Data-Admin-Operator-ID), you can map claims to operator properties like this:
3. OperatorID.pyEmail = {email}
4. OperatorID.pyFirstName = {given_name}
5. OperatorID.pyLastName = {family_name}
6. OperatorID.pyAccessGroup = {primaryGroup}
7. OperatorID.pyAccessGroupsAdditional = {groups}
8. Working with Claim Arrays If your OIDC provider returns array values (like for groups or roles), you can reference specific elements:
9. OperatorID.pyAccessGroup = {groups[0]}  // First group in the array
10. Using Claims in Expressions You can also use claims in more complex expressions:
11. OperatorID.pyUserIdentifier = {sub} + "@" + {domain}

Be sure that your AssignOktaAG data transform is properly referenced in your OIDC authentication service configuration, as shown in your screenshot.

For this to work properly, make sure the claims you're referencing are actually being sent by your Okta OIDC provider. You may need to configure your Okta application to include these claims in the token.

References: Creating an OIDC SSO authentication service in App Studio Identity mapping Configuring operator provisioning for an OpenID Connect SSO authentication service