Network Management

SAML Group login fails: "Groups Claim 'OrionGroups' Is Missing" when using Okta in the SolarWinds Platform

Users assigned to an Okta group cannot log in to the SolarWinds Platform via SAML SSO. The SAML Configuration Test shows authentication succeeding but Groups: N/A, with the warning "Groups claim 'OrionGroups' is missing. This claim is required for authorization via SAML groups and has to be configured in your Identity Provider." Individual SAML accounts work correctly.

First published date

7/22/2026 9:28 PM

Last published date

7/22/2026 9:36 PM

Overview

Environment

  • SolarWinds Observability Self-Hosted (SWOH) / SolarWinds Platform — all versions supporting SAML SSO

  • Identity Provider: Okta

Symptoms

  • Individual SAML user accounts log in successfully via Okta SSO

  • Users who are members of an Okta group assigned to the SolarWinds SAML application cannot log in via Okta SSO

  • The SAML Configuration Test (Settings > All Settings > SAML Configuration > Test) shows:

    • Authentication: Succeeded

    • Groups: N/A

    • Warning: "Groups claim 'OrionGroups' is missing. This claim is required for authorization via SAML groups and has to be configured in your Identity Provider."

  • The SAML group account is correctly configured in SolarWinds (Settings > All Settings > Manage Accounts > SAML group accounts)

  • The Okta group is correctly assigned to the SolarWinds SAML application under the Okta Assignments tab

Product section

Network Performance Monitor

Cause

There are two separate configurations in Okta that are commonly confused:

  • Assignments tab — Controls which users and groups can access the Okta application. Assigning a group here does NOT automatically include group membership in the SAML assertion sent to SolarWinds.

  • Group Attribute Statements (Sign On > SAML Settings) — Controls whether Okta includes group membership as a named attribute in the SAML assertion. This must be explicitly configured with the attribute name OrionGroups for SolarWinds to receive and process group information.

When the Group Attribute Statement for OrionGroups is not configured in Okta's SAML Settings, Okta never sends the group claim in the SAML response. SolarWinds receives no group information and cannot match the user to any SAML group account, causing authorization to fail even though authentication succeeded.

Resolution

Step 1 — Confirm the Symptom via SAML Configuration Test

  • Go to Settings > All Settings > SAML Configuration in the SolarWinds Platform Web Console

  • Click Test Configuration next to the configured Okta Identity Provider

  • Confirm the test result shows Groups: N/A and the "Groups claim 'OrionGroups' is missing" warning

  • If the test shows a specific group name instead of N/A, the Group Attribute Statement is already sending — refer to SAML authentication is not working on SolarWinds Platform using SAML groups for group name mismatch troubleshooting instead

Step 2 — Add the Group Attribute Statement in Okta (No Downtime Required — Okta-Side Change Only)

The steps below are based on Okta's documentation and interface at the time of writing. SolarWinds does not own, maintain, or support Okta's product or documentation. If the steps below do not match your Okta interface, refer to Okta's official documentation or contact Okta support for the most current guidance.

  • Log in to the Okta Admin Console

  • Go to Applications > Applications and open the SolarWinds SAML application

  • Click the Sign On tab > SAML Settings > Edit

  • Scroll down to the Group Attribute Statements section

  • Add the following entry:

    • Name: OrionGroups

    • Name format: Unspecified

    • Filter: Matches regex

    • Value: .*

  • Save the changes in Okta

No changes are required on the SolarWinds side. If the SAML group account in SolarWinds is already configured with the correct group name, it will work automatically once Okta begins sending the OrionGroups claim.

Step 3 — Verify

  • Go to Settings > All Settings > SAML Configuration in the SolarWinds Platform Web Console

  • Click Test Configuration next to the configured Okta Identity Provider

  • Confirm the test result shows the group name (e.g., auth_solarwinds_admin) under Groups — it must exactly match the SAML group name configured in SolarWinds (case-sensitive)

  • Confirm the "Groups claim 'OrionGroups' is missing" warning is no longer present

  • Attempt to log in via the Log In with Okta button using an account that is a member of the Okta group to confirm end-to-end group-based login works

Notes

  • The group name sent by Okta in the OrionGroups attribute must exactly match the SAML group account name configured in SolarWinds — the comparison is case-sensitive

  • The Filter value .* (Matches regex) sends all Okta groups the user belongs to in the SAML assertion. Okta supports additional filter options for the Group Attribute Statement — refer to Okta's official documentation for available filter types and values if you prefer to limit which groups are sent

  • If a user is a member of multiple SAML group accounts configured in SolarWinds, the permissions of the group that is highest on the Groups tab in Manage Accounts are applied — permissions are not cumulative across groups

  • This issue is separate from the Okta Assignments tab configuration — both must be correctly set for group-based SSO to work