Tenant admins can map identity-provider groups to roles or job functions for each library. When a person signs in through the configured SAML connection, Phoenix synchronises the groups provided by the identity provider with those mappings.

Check the prerequisites

  • The library must use the WorkOS SSO connection with SAML group claims configured.
  • The group values must be included in the idp_groups attribute sent by the SAML connection.
  • OIDC group claims are not supported by this group-mapping feature.

Add a group mapping

  1. Open Users and choose Roles & Users.
  2. Open the IdP Groups tab and select Map Group.
  3. Enter the group value sent by your identity provider and a label your admins will recognise.
  4. Choose whether the group grants a Role or a Job Function, select the target, and save the mapping.

Group membership is synchronised when a person signs in, for the active library. If you have just changed a mapping, affected people see the update on their next page after sign-in.

To map groups from a role or job-function management view, use its IdP Groups option where available.