---
title: "Comment by Steven Mock on \"Beyond SSO: Extracting SAML Group Claims in Oracle APEX with PL/SQL\" | Hashnode"
description: "The part that surprised me most was finding the SAML XML sitting in G_X01. That's the kind of undocumented behavior you only find by poking around in a playgrou"
url: "https://hashnode.com/posts/beyond-sso-extracting-saml-group-claims-in-oracle-apex-with-pl-sql/6aedd8ee0fa8ab38bf0804ea/comment/6aeeb0a5ad182b2ffc52f6d2"
---

[Discussion](https://hashnode.com/posts/beyond-sso-extracting-saml-group-claims-in-oracle-apex-with-pl-sql/6aedd8ee0fa8ab38bf0804ea)

Comment [Beyond SSO: Extracting SAML Group Claims in Oracle APEX with PL/SQL](https://hashnode.com/posts/beyond-sso-extracting-saml-group-claims-in-oracle-apex-with-pl-sql/6aedd8ee0fa8ab38bf0804ea)

[Steven Mock](https://hashnode.com/@stevenmock)

[5d ago](https://hashnode.com/posts/beyond-sso-extracting-saml-group-claims-in-oracle-apex-with-pl-sql/6aedd8ee0fa8ab38bf0804ea/comment/6aeeb0a5ad182b2ffc52f6d2)

The part that surprised me most was finding the SAML XML sitting in G\_X01. That's the kind of undocumented behavior you only find by poking around in a playground, and it's what makes this post useful — the official docs wouldn't have told you that. Using group IDs instead of group names is the right call, too. A rename shouldn't silently change who gets admin access. And getting this done without a separate Graph call keeps the login flow simple, which matters more than it looks. Thanks for writing up the full chain, Entra claim to session state, instead of just the extraction query.