mirror of
https://github.com/hanzoai/kms.git
synced 2026-11-03 01:10:24 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
55 lines
2.4 KiB
Plaintext
55 lines
2.4 KiB
Plaintext
---
|
|
title: "General OIDC Group Membership Mapping"
|
|
sidebarTitle: "Group Membership Mapping"
|
|
description: "Learn how to sync OIDC group members to matching groups in KMS."
|
|
---
|
|
|
|
You can have KMS automatically sync group
|
|
memberships between your OIDC provider and KMS by configuring a `groups` claim on your provider tokens.
|
|
When a user logs in via OIDC, they will be added to KMS groups that are present in their OIDC `groups` claim,
|
|
and removed from any KMS groups not present in the claim.
|
|
|
|
<Info>
|
|
When enabled, manual
|
|
management of KMS group memberships will be disabled.
|
|
</Info>
|
|
|
|
<Warning>
|
|
Group membership changes in your OIDC provider only sync with KMS when a
|
|
user logs in via OIDC. For example, if you remove a user from a group in your OIDC provider,
|
|
this change will not be reflected in KMS until their next OIDC login.
|
|
To ensure this behavior, KMS recommends enabling Enforce OIDC SSO in the OIDC settings.
|
|
</Warning>
|
|
|
|
|
|
<Steps>
|
|
<Step title="Configure a groups claim in your OIDC provider">
|
|
To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider.
|
|
|
|
Add a `groups` property with a list of the user's OIDC group names to your token.
|
|
|
|
Example of expected token payload:
|
|
```json
|
|
{
|
|
// "email": "[email protected]",
|
|
// "given_name": "John",
|
|
// ...other claims
|
|
"groups": ["Billing Group", "Sales Group"]
|
|
}
|
|
```
|
|
|
|
<Note>
|
|
Setup varies between OIDC providers. Please refer to your OIDC provider's documentation for more information.
|
|
</Note>
|
|
</Step>
|
|
<Step title="Setup groups in KMS and enable OIDC Group Membership Mapping">
|
|
2.1. In KMS, create any groups you would like to sync users to. Make sure the name of the KMS group is an exact match of the OIDC group name.
|
|
|
|
|
|
2.2. Next, enable **OIDC Group Membership Mapping** on the **Single Sign-On (SSO)** page under the **General** tab.
|
|
|
|
|
|
2.3. The next time a user logs in they will be synced to their matching OIDC groups.
|
|
|
|
</Step>
|
|
</Steps> |