Group mappings

A group mapping turns a group a person has elsewhere into a portal group or role. A directory’s groups give, for example, everyone in cn=editors,ou=groups,dc=example,dc=ro the portal group Editors, and everyone in cn=portal-admins,... the Administrator role.

Mappings are kept per directory and per sign-in provider, at the bottom of its window.

Press Add mapping.
Type the outside group: for a directory, the group’s DN; for a provider, the group’s name or ID as the provider sends it.
Choose the portal group or role it gives.
Press Save mappings. A row with only one of its two halves filled in is refused: complete it or remove it.

While a directory’s mappings are unsaved, Sync now waits. Closing the window with unsaved mappings asks before discarding them.

Upper and lower case do not matter, nor do spaces after the commas of a DN.

When mappings apply

A directory’s mappings apply at every sign-in through it, and at every sync.
A provider’s mappings apply at every sign-in through it. The provider must send the groups: set Groups claim (OpenID Connect) or Groups attribute (SAML) on the provider.

Each time, the person gets exactly the groups and roles the mappings give them, and loses the ones that no longer apply.

Changing or removing a mapping takes its group or role at once from everyone the directory or provider gave it to. Their next sign-in, or the directory’s next sync, gives it back to whoever still qualifies.

Mapped and hand-given access

Groups and roles an administrator gives by hand are never touched by mappings. On a user’s page, the Roles card shows the roles given by hand as tick boxes, and lists below them each role a directory or provider gives, with that source’s name. A group’s Members card shows members a directory gave as From the directory; only the directory can take them away. Someone given both by hand and by a directory is listed once, with From the directory.

The portal always keeps one active administrator: a mapping never takes the role from the last one.