---
title: Set SAML Single Sign-On User Group Mapping Rules
canonical: https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules/
product: CloudConnexa Docs
description: Suppose you have configured different User Groups and Access Groups to provide these User Groups with least privilege access to authorized resources. In that case, you can easily enforce these access restrictions based on any appropriate user information being maintained in your Identity Provider by using SAML User Group mapping rules.
keywords: SAML User Group Mapping
---

# Set SAML Single Sign-On User Group Mapping Rules

If you have configured different User Groups and Access Groups to provide these User Groups with least privilege access to authorized resources, you can easily enforce these access restrictions based on any appropriate user information being maintained in your Identity Provider by using SAML User Group mapping rules.

To use attribute-based access control based on the department, you created different CloudConnexa User Groups and Applications and have configured Access Groups restricting each User Group to access only applications authorized for that department. For example, User Group **HR** can access **App A, X, and Y**, and User Group **Finance** can access **App B and Z**. Now what is left to do is to get the department information when a user logs in with SSO and assign the user to the correct CloudConnexa User Group. SAML User Group Mapping Rules allow you to map the values of a SAML attribute selected to represent the Group to specific CloudConnexa User Groups.

> **Note**
>
> You need to configure your Identity Provider to send the attribute that contains the values you want to map to User Groups in response to the authentication request. Refer to [SAML Configuration Tutorials](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules/#bridgehead-id113448449216355) and [SAML Configuration Videos](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules/#bridgehead-id111885913250925).

Once you have mapped the attribute being sent across by the IdP to **Group** in the **Attribute Mapping** step(refer to [SAML Single Sign-On](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md)), add a SAML User Group Mapping rule by following the steps below:

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Settings \> User Authentication**.
3. Click **Edit**, which is located in the top right corner.
4. Click **User Group Mapping** in the **SAML Single Sign-On** section.
5. Toggle the **User Group Sync from IdP** switch to ON.
6. Click **Add Rule**.
7. Enter the value(s) set in the IdP attribute and select one of the CloudConnexa User Groups from the drop-down it should map to. Provide a **Priority** to the rule, with **1** being the highest.

   > **Note**
   >
   > If the IdP provided value matches with multiple rules, the one with the highest priority will be used to map the User to the CloudConnexa User Group. If the value does not match with any of the mapping rules, the User will be mapped to the CloudConnexa User Group configured in the **Unmapped SAML IdP User Groups** section.
8. Click **Add Rule**
9. Click **Cancel** to exit.

> **Note**
>
> CloudConnexa will receive any user configuration change made on the Identity Provider after the user’s next successful authentication. If a user is deleted or disabled on IdP, the user must be deleted from CloudConnexa.

## Assignment of Primary and Secondary User Groups with LDAP or SAML Authentication

The User Group Mapping feature allows automatic assignment of CloudConnexa User Groups based on identity attributes received from an external Identity Provider (IdP), such as SAML or LDAP. This Group Mapping has been revised to support Primary and Secondary User Groups through IdP-based mapping.

The User Groups Mapping Rules have a Processing Order to reflect the sequential nature of rule evaluation. Lower numbers (e.g., "1") mean higher priority. The first matching rule defines the User's Primary User Group. All subsequent matching rules define Secondary User Groups (max 20) for the User.

> **Note**
>
> User Group Mapping Rules that existed before the introduction of this enhancement will continue to assign the User to a single User Group based on the first matched rule.
>
> To activate Multiple User Group Mapping, click the Enable button in the info message.

> **Caution**
>
> Before enabling Multiple User Group mapping, it is critical to review the mapping rules and evaluate the access rights granted by each CloudConnexa User Group. If multiple IdP User Groups are received, all the received groups will be mapped, assigning users to multiple CloudConnexa User Groups and expanding their access. This may result in broader permissions than originally intended, introducing potential security risks.
>
> New mapping logic will apply only when new users log in or existing users reauthenticate.

## Tutorial showing how to set SAML User Group Mapping Rules

## Edit a User Group Mapping Rule

To edit a User Group Mapping Rule, follow the steps below:

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Settings \> User Authentication**.
3. Click **Edit**, which is located in the top right corner.
4. Click **User Group Mapping** in the **SAML Single Sign-On** section.
5. The list of rules will be shown in the **User Group Mapping Rules** table with the **Edit**  and the **Delete**  icons for each rule record. Each rule record will also have **Decrement**  and **Increment**  icons.
6. Click the **Edit** icon next to the rule record that needs to be changed.
7. Make the required changes.
8. Click **Update Rule**.
9. Click **Cancel** to exit.

## Change the priority of a User Group Mapping Rule

If the IdP provided value matches with multiple rules, the one with the highest priority will be used to map the User to the CloudConnexa User Group. If the value does not match with any of the mapping rules, the User will be mapped to the CloudConnexa User Group configured in the **Unmapped SAML IdP User Groups** section.

To change the priority of a rule, you can [edit it](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules/#edit-a-user-group-mapping-rule-101903) and change the priority value, or you can use the **Decrement**  and **Increment**  icons by following the steps below:

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Settings \> User Authentication**.
3. Click **Edit**, which is located in the top right corner.
4. Click **User Group Mapping** in the **SAML Single Sign-On** section.
5. The list of rules will be shown in the **User Group Mapping Rules** table with the **Edit**  and the **Delete**  icons for each rule record. Each rule record will also have **Decrement**  and **Increment**  icons.
6. Click the **Increment/Decrement** icons next to the rules to arrange the rules by the needed priority in the table. The priorities of the affected rules are automatically updated.
7. Click **Cancel** to exit.

## Delete a User Group Mapping Rule

To delete a User Group mapping rule, follow the steps below:

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Settings \> User Authentication**.
3. Click **Edit**, which is located in the top right corner.
4. Click **User Group Mapping** in the **SAML Single Sign-On** section.
5. The list of rules will be shown in the **User Group Mapping Rules** table with the **Edit**  and the **Delete**  icons for each rule record. Each rule record will also have **Decrement**  and **Increment**  icons.
6. Click the **Delete** icon next to the rule record that needs to be deleted.
7. Click **Delete** in the confirmation dialog box.
8. Click **Cancel** to exit.

## Related Tutorials and Videos

### SAML Configuration Tutorials

- [Authenticate Using SAML with Microsoft Entra ID](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-microsoft-entra-id.md)
- [Authenticate Using SAML with Okta](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-okta.md)
- [Authenticate Using SAML with Google Workspace](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-google-workspace.md)
- [Authenticate Using SAML with Keycloak](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-keycloak.md)
- [Authenticate Using SAML with OneLogin](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-onelogin.md)
- [Authenticate Using SAML with JumpCloud](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-jumpcloud.md)
- [Set Up IdP-Initiated SAML SSO to the User Portal](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--set-up-idp-initiated-saml-sso-to-the-user-portal.md)

### SAML Configuration Videos

- [Video: Configure Authentication With SAML and Azure AD (Entra ID)](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--configure-authentication-with-saml-and-azure-ad--entra-id.md)
- [Video: Map Microsoft Entra ID SAML Attribute to CloudConnexa User Groups](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--map-microsoft-entra-id-saml-attribute-to-cloudconnexa-user-groups.md)
- [Video: Configure Authentication With SAML and Okta](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--configure-authentication-with-saml-and-okta.md)
- [Video: Map Okta SAML Attribute to CloudConnexa User Groups](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--map-okta-saml-attribute-to-cloudconnexa-user-groups.md)
- [Video: Configure Authentication With SAML and OneLogin](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--configure-authentication-with-saml-and-onelogin.md)

---

Prev: [SAML and SCIM SP Endpoints](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/saml-and-scim-service-provider-endpoints-for-cloudconnexa.md)
Next: [Multiple Auth Methods](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/about-multiple-authentication-methods.md)
Index: https://openvpn.net/cloud-docs/llms.txt