Mapping IdP Groups to Roles
Group-to-role resolution is the single authorization join for federation and is provider-agnostic by construction: the transport (Entra/Okta over SAML or OIDC, Google or Cognito over OIDC, on-prem AD/OpenLDAP over LDAP) normalizes to a group-claim set, and that set is matched against role definitions independent of which IdP produced it. Roles gate which DB DevOps sections render in the user's navigation. Enforcement altitude matters: section grants drive UI visibility, while server-side authorization is coarse, applied at the role and license-tier boundary, not per section, so treat section grants as navigation shaping layered on top of role/tier enforcement, not as a fine-grained server ACL.
Configuration
- Administration → Roles & Access → create/edit a role and select the sections it grants.
- In the role's Identity-provider groups field, list the IdP group names/claims (comma-separated) that map to it, e.g.
DB-Admins, platform-engineers. Matching is on the claim value and case-insensitive, for providers that emit opaque group identifiers (Entra object GUIDs, unmapped LDAP DNs) enter the value the assertion actually carries. - Save. The same group names apply across every configured IdP, so a single mapping table covers a mixed-provider estate.
Resolution on Login
Each SSO login recomputes membership: the incoming claim set is intersected with every role's mapped groups, the matching roles are assigned just-in-time (provisioning the account on first login), and the user sees the union of those roles' sections. An empty intersection leaves existing/default access intact rather than stripping it, so a claim-plumbing failure degrades to least privilege instead of lockout or over-grant. Because resolution is live per login, revoke or elevate by editing IdP group membership; admins can also pin roles manually under Roles & Access for accounts that should not track their group claims.