Enabling Burp Suite DAST to access your Okta groups - Port Swigger
Summary: PortSwigger documentation describes how Burp Suite DAST can match its local groups to Okta groups when SCIM is not in use, by creating Group Attribute Statements in Okta with a filter value whose regex sends all groups. If the Okta integration already sends group membership under a different attribute name, that name is entered in Burp Suite DAST instead, and permissions are granted by setting the Identity provider group value on each locally created group.
Key Takeaway: Group-to-role mapping through a single Okta attribute statement means the regex in that filter decides which groups reach Burp Suite DAST, and a misconfigured filter or mismatched attribute name can leave access permissions assigned to the wrong people.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026