Pass role and team assignments from your identity provider

Kobiton can assign roles and teams from identity provider (IdP) group memberships each time a user signs in through SSO. Setup has two parts: create the groups in your IdP and send them in the SAML assertion, then map each group name to a Kobiton role or team in Kobiton Portal.

For switch behavior and dependencies, see SSO enforcement and role assignment.

Before you start

  • Your Kobiton account is assigned the ADMIN role or the org_setting.modify_sso_setting permission.

  • A valid SSO configuration is added, verified, and saved in Settings > SSO Settings. See About Single Sign-On (SSO) authentication.

  • Enforce users to login to Kobiton only through SSO is turned on in Settings > SSO Settings.

  • You have administrator access to your IdP to create groups and edit SAML attributes.

Step 1: Set up groups in your identity provider

Plan the group names

Choose one IdP group for each Kobiton role and team that the IdP drives, and one group for organization administrators. Members of the administrator group receive the predefined ADMIN role in Kobiton.

Kobiton matches group values as literal text, so record each group name exactly as your IdP sends it.

Create the groups

  1. Create each group in your IdP.

  2. Add users to the groups that match the roles and teams they need in Kobiton.

  3. Add your own IdP account to the administrator group.

    Role and team passthrough requires the administrator group to exist in your IdP and your account to belong to it. Confirm both before you continue to Step 2.

For provider-specific steps, use your IdP’s documentation:

Okta
OneLogin

  • Roles

    Kobiton reads OneLogin User Roles as group membership. Create a role rather than a group.

PingOne

Send the group names in the memberOf attribute

Kobiton reads group membership from the memberOf attribute in the SAML assertion. Configure your IdP to send it.

Identity provider Group attribute configuration

Okta

In Group attribute statements, add the name memberOf with the name format Basic, then set Filter to Matches regex and enter .*. See Use Okta for SSO authentication.

OneLogin

Add a custom parameter with the field name memberOf and the value User Roles, then select Include in SAML assertion. See Use OneLogin for SSO authentication.

PingOne

On the Attribute Mappings tab, map memberOf to Group Names. See Use Ping Identity for SSO authentication.

If your IdP is not listed, add a SAML attribute named memberOf whose value is the user’s group membership.

If your IdP cannot send the attribute under the name memberOf, map your IdP’s attribute name to memberOf instead. See Configure custom SAML attribute mappings.

Step 2: Map the groups in Kobiton Portal

Turn on role and team passthrough

  1. Open Settings > SSO Settings.

  2. In Org Admin Team, enter the IdP group name for organization administrators.

  3. Turn on Pass role / team assignments to users in the SAML validations.

  4. Save your SSO settings.

Pass role and team assignments switch and the Org Admin Team field in Settings > SSO Settings

The SSO Attribute Value field on teams and roles appears only while passthrough is on.

The SSO Attribute Value for the predefined ADMIN role always matches Org Admin Team. Updating either field updates the other.

Map a group to a team

  1. Open Org Management > Teams.

  2. Select an existing team or create a team.

  3. In SSO Attribute Value, enter the IdP group name that maps to this team.

  4. To map more than one group to the team, separate the values with ; or press Enter after each value.

  5. Save the team.

Map a group to a role

  1. Open Org Management > Roles.

  2. Select an existing role or create a role.

  3. In SSO Attribute Value, enter the IdP group name that maps to this role.

  4. To map more than one group to the role, separate the values with ; or press Enter after each value.

  5. Save the role.

Verify the setup

  1. Sign out of Kobiton.

  2. Sign in through SSO with an account that belongs to one of the mapped IdP groups.

  3. Open Org Management > Users and confirm the account shows the expected role and team.

Kobiton reevaluates roles and teams at each SSO sign-in.

What changes while passthrough is on

  • The Invite button in Org Management > Users is turned off. Create new users in your IdP.

  • Manual role assignment in Org Management > Users and Org Management > Roles is turned off.

  • Users in the Org Admin Team group receive the ADMIN role and are not assigned additional teams through group mapping.

  • Users who are not in the Org Admin Team group receive the predefined MEMBER role.

  • Users are removed from a Kobiton role or team when no current IdP group matches its SSO Attribute Value.

  • All users remain assigned to Default Team regardless of IdP group membership.

  • Users who exist in Kobiton but not in your IdP keep their current roles and teams.

Related guides