Apidog does not support creating or deleting groups using SCIM. However, mapping an identity provider (IdP)'s group to a team within your Apidog organization via SAML is supported.Updated Text: Here is a step-by-step video tutorial on how to enable Apidog SAML Group Mapping using Microsoft Entra ID (Azure AD) as an IdP.Modifying Claim of SSO#
To support group mapping via SAML, you should add a group claim of SSO:1.
Open your Microsoft Entra ID management portal in a browser.
2.
Go to Enterprise applications and open your enterprise application.
3.
On the application's Overview page, click Set up single sign on, and edit Attributes & Claims.
4.
Click Add a group claim, select All groups, check Customize the name of the group claim, and set "Name" to "groups".
Configuring Mapping#
Next, we can configure the mapping between group and team:1.
Open the Groups page of Microsoft EntraID, you can find that each group has a Name and Object Id.
2.
Open the SAML Group page in the organization settings of Apidog, then you can paste the name and id of the Azure group.
3.
Set the permissions of members of this Azure group on each Apidog team.
Initial project permissions for mapped users#
When a user signs in with SSO and their SAML groups attribute matches a configured SAML group mapping, Apidog adds the user to the mapped teams and assigns initial project permissions for projects in those teams.The initial project permission is derived from the mapped team role:| Mapped team role | Initial project role |
|---|
| Team Admin | Project Maintainer |
| Team Member | Project Readonly |
| Team Guest | Project Readonly |
Initial project permissions are applied when the user is synced through SAML group mapping. Apidog creates missing project memberships or updates project memberships with no role.Existing project roles that have already been assigned are not overwritten. For example, if an admin has manually changed a user’s project role, SAML group mapping does not reset that role during later SSO sign-ins.SAML group mapping does not provide a separate per-project role setting. To change a user’s project role, update the project member permissions after the user has been added to the team.If a user is no longer included in a mapped SAML group, Apidog may remove the user from the corresponding team during SAML sync. When the team membership is removed, the user’s project memberships in that team are also removed.
