The &Open platform can automatically assign users to the correct team. This is done during login and ensures that users are immediately assigned to the correct team.
How It Works
When a user authenticates via SAML/SSO:
The platform extracts the
groupsattribute from the SAML responseEach group identifier is matched (case-insensitive) against the SSO Identifiers configured on teams
The user is assigned to the first matching enabled team
If no match is found, the user is assigned to the default team
Note: Users who already have a team assigned will not be reassigned on subsequent logins.
Where to Configure
Admin → Teams (/admin/teams)
Each team has an SSO Identifiers field where you can enter a comma-separated list of SSO group names.
Steps
Navigate to Admin → Teams
Click on the team you want to configure
In the SSO Identifiers field, enter the group identifier(s) that should map to this team
Use commas to separate multiple identifiers (e.g.,
engineering, platform-team, devops)Save the team
Note: The SSO Identifiers field only appears when SAML is enabled for the tenant.
Matching Behavior
Behavior | Description |
Case-insensitive |
|
First match wins | If a user belongs to multiple groups matching different teams, the first match is used |
Enabled teams only | Disabled teams are ignored during matching |
New users only | Users with an existing team assignment are not reassigned |
Default fallback | Users with no matching groups go to the default team |
Requirements
From the Identity Provider (IdP)
The IdP must be configured to send a groups attribute in the SAML response containing the user's group memberships.
Example SAML response attribute:
<saml:Attribute Name="groups"> <saml:AttributeValue>engineering</saml:AttributeValue> <saml:AttributeValue>platform-team</saml:AttributeValue> </saml:Attribute>
From the Client
The client needs to provide:
The exact group identifier values that their IdP sends in the SAML response
Which team should each group map to
Example
Scenario: A company has three teams and wants to map SSO groups to them.
Team Name | SSO Identifiers |
Marketing |
|
Engineering |
|
Sales |
|
When a user logs in with groups ["eng-team", "developers"], they will be assigned to the Engineering team.
Limitations
Single team assignment: Users can only belong to one team; if they match multiple, only the first match is used
IdP configuration required: The IdP must be configured to send the
groupsattributeExact value matching: The SSO identifier must exactly match what the IdP sends (after lowercasing)
Troubleshooting
Issue | Possible Cause |
User assigned to wrong team | Check if their groups match multiple teams; first match wins |
User assigned to default team | The groups from their IdP don't match any configured SSO identifiers |
SSO Identifiers field not visible | SAML is not enabled for this tenant |
User's team not updating | Users with existing team assignments are not reassigned |