SSO config enables you to manage group mapping for your account. Group mapping automatically assigns Traceable roles to users based on the group or claim information that your identity provider sends during single sign-on. This removes the need to manually assign a role to every individual user. Traceable supports group mapping for both SAML and OIDC identity providers, and you can manage mappings for both protocols from the same SSO Config page.
What you will learn from this topic
By the end of this topic, you will be able to:
Understand the purpose and structure of SSO Config.
Create and manage SAML and OIDC group mappings.
Map an identity provider group to one or more Traceable roles and scopes.
Troubleshoot a group mapping that fails to assign the expected role.
Before you begin
Before you configure a group mapping, make a note of the following:
Make sure that you have the Traceable Account Owner with Edit privileges at the Team level.
Make sure that single sign-on is already configured for your organization, since group mapping matches against the information sent by that configuration. For more information, see Authentication and Users.
Make sure that you have identified or created the Traceable roles you wish to assign, along with the scope each one should apply to. For more information, see Role-Based Access Control (RBAC).
Understand group mapping
When a user signs in through your identity provider, Traceable evaluates the group or claim information included in the SSO response. If that information matches a group mapping you have configured, Traceable automatically assigns the mapped role(s) to the user at the specified scope. You do not need to create the user manually or assign a role to them after they sign in for the first time. Traceable handles this assignment each time the user signs in, so any change you make to a group mapping takes effect the next time the affected users authenticate.
The following table describes each group mapping type and its configuration:
Group Mapping Type | Configuration |
|---|---|
SAML | Create a mapping with the Type set to SAML, and specify the group attribute name configured in your SAML assertion. For more information, see SAML Configuration. |
OIDC | Create a mapping with the Type set to OIDC, and specify the claim name configured by your OIDC provider. For more information, see Configure OIDC group mapping. |
Access group mapping
Navigate to Settings → Team → SSO Config tab to view and manage your group mappings. The Group Mapping section lists all mappings you have already configured, as shown below:
.png)
SSO Config
Group Attribute Name — The attribute or claim name that Traceable checks in the SSO response, along with a label that identifies whether the mapping uses SAML or OIDC.
Mapped Traceable Roles — Every role that Traceable assigns when a user belongs to the group or groups configured under that attribute name. For more information about what each role permits, see Role-Based Access Control (RBAC).
Create a group mapping
You can configure a group mapping in two stages:
Specify the attribute or claim that Traceable uses to identify group information in the SSO response.
Specify the group values for that attribute, and map each value to the appropriate role and scope.
Complete the following steps to create a group mapping:
.png)
Group Mapping
Click + Add group.
In the Type dropdown in the Map Group to Roles panel, select SAML or OIDC, based on how your identity provider sends group information.
In the SAML Group Attribute Name or OIDC Group Attribute/Claim Name field, specify the attribute or claim name exactly as it appears in the SSO response. For example, if the group information is sent under
demo_group, specifydemo_group.Click + Add Group to add a group value that Traceable should match against the attribute or claim. Select the group entry to open the SAML Group or OIDC Group panel, where you can enter the exact group value and configure its roles and scopes.
In the SAML Group or OIDC Group panel, click Add Role and configure the following:
Role — Select the Traceable role to assign to users in the group, such as Developer or Account Owner. For more information, see Role-Based Access Control (RBAC).
Scope — Select the scope at which Traceable applies the role, such as All. For more information, see Authentication and Users.
Note
You can assign multiple roles to the same group. Click Add Role to add another role and scope combination.
If your identity provider sends multiple group values under the same attribute or claim, repeat steps 4 and 5 for each group. Each group appears as a separate entry, allowing you to configure its roles and scopes independently.
Click Save.
Configure group mapping with a specific identity provider
If you use SAML and want provider-specific setup instructions, including how to add the group attribute to the assertion on the identity provider side, see the following guides:
Troubleshooting
If a user signs in and does not receive the role you expect, check the following before contacting support:
Make sure that the attribute or claim name configured in Traceable exactly matches the value your identity provider sends, including case.
Make sure that the specific group value configured under that attribute matches the value your identity provider sends for that user, including case.
Make sure the user is actually assigned to the group in your identity provider, not just added to the application itself.
For more information, see SAML Configuration.