Versions Compared

Old Version 4

changes.mady.by.user Joel Wenzel

Saved on

compared with

New Version 5

changes.mady.by.user Joel Wenzel

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Area

Description

1

Enable Group Mapping

This should be enabled if you want to associate the SSO groups assigned to a user to FlexDeploy groups. Changing this flag will require a restart of FlexDeploy.

2

Group Attribute Name

When logging in via SSO, a user profile object is returned from the SSO provider that often includes things like username, display name, email etc. This also typically includes a field for the SSO groups the user belongs to. The name of that group/role field should be specified here. If the field is named groups or roles you do not need to specify this field as those will automatically be checked.

Panel
panelIconIdatlassian-check_mark
panelIcon:check_mark:
bgColor#E6FCFF
Microsoft Azure or Okta

Both Microsoft Azure and Okta return groups or roles. As such, you can omit this field if you are using one of those SSO providers.

Info
Other providers

If you don’t know what to put, you will need to set the org.pac4j logging to FINEST and login with an SSO user. This should log the user profile object and you can inspect to find the groups or roles field.

Then set the logging back to info and look for the groups in the logs. If you can’t find them, share the logs with the FlexDeploy support team.

3

Group Mapping

In this location is where SSO groups will be mapped to FlexDeploy groups. Unlike LDAP group mapping, the available SSO groups are not displayed and instead must be manually entered.

Info
What to enter

Whether to specify group names, ids, or some other identifier depends upon what is returned in the SSO user profile group field (see group attribute name above)

See below for a more detailed explanation of group mapping

...