How to change SAML-Mappings (SSO)

After a full SSO Setup was configured either by you or by BOC, you can adapt the existing configuration to your needs at any time.

Please note: SAML mapping in connection with synchronisation settings influences, which user is in which usergroup, has access, desired rights, and systemroles. If you are unsure, about a configuration change to a setup, that was done by BOC, you can request assistance through the inital setup ticket for up to 5 times within a month after finalization. 

If support is needed after this month, please reach out to your key account manager to administer an individual solution.

A full SAML mapping setup can be done with the help of our ADONIS and ADOIT SAML - Guides.

For ADOGRC, please reach out to your key account manager. 

Procedure

To change the group assignment as part of the SSO login, please proceed as follows:

 

1.) Log in to the administration interface with an admin user.

2.) Call up the configuration via the Authentication settings.

3.) In the corresponding connector, click on Edit (1) and switch to the 04 User Mapping (2) tab

 

There you can create “mappings” between your AD and your BOC Management Product for groups, roles, licenses and repositories.

These mappings check for certain strings in an attribute, which ADONIS or ADOIT expects from your Active Directory, during user login.

Example

If the word Designer is included in your ADs group claim, the user is assigned to the selected Top Level user group.

 

The basic assignments work as a fallback-configuration that is activated, if a user does not match any of the configured mappings.

 

In the Synchronize user menu, you can control whether this synchronization should be carried out at every login.

Note: Even if sync is not enabled, it will be applied during first user creation.


 

This means, that your BOC Management Product reacts directly to changes to the AD groups of individual users during login.

Use case: A former designer becomes a reader as soon as a login occurs without the corresponding AD group).

The disadvantage: Any changes made by an admin in ADONIS or ADOIT to a user are overwritten by SAML the next time the user logs in.