Register an IdP group and grant collection access

In the previous lesson, you registered an IdP user in D.Hub and verified SSO login. As your user base grows, you can register an organization group from the IdP and manage access for the group instead of granting permissions one user at a time.

In this lesson, you will register an existing IdP group in D.Hub, verify its synchronized members, and grant the group a collection role.

The access grant follows one dependent sequence from account preparation through verification.

flowchart LR
    accTitle: Grant collection access through a group
    accDescr: Prepare a user, prepare the group, verify group membership, share the collection with the group, and confirm access as the user.
    user[Prepare user] --> group[Prepare group]
    group --> members[Verify group members]
    members --> share[Share collection with group]
    share --> verify[Verify as the user]

Use a member whose account type is User to verify the granted role. Account type and resource role are separate: User does not mean globally read-only, and the member's Reader, Writer, or Owner role determines what they can do in the collection. Users can create assets such as datasets, Code, and pipelines inside an authorized collection; creating collections or connectors and importing scenarios requires a Manager or Administrator. An Administrator can bypass the restrictions this lesson is meant to verify.

Understand local and OIDC groups

• A local group is created and managed in D.Hub. It can contain both local users and registered OIDC users.
• An OIDC group is an external IdP group registered in D.Hub. D.Hub preserves the IdP group's identifier and name; you do not create a separate “IdP group → D.Hub group” mapping.

With a write-capable IdP, creating or changing OIDC groups and memberships in D.Hub writes those changes back to the IdP. With a read-only IdP, manage groups and memberships in the IdP, and then register or sync them into D.Hub.

Step 1: Register an IdP group

1. In the sidebar, open System → Settings → Groups.
2. Select Register in the upper-right corner. The dialog title identifies the connected IdP.
3. Search for the group by name.
4. Select the target group whose status is Not Registered, and then select Register.
5. Confirm that its provider is shown as OIDC in the group list.

With a write-capable IdP, you can also select the IdP in Create Group to create a new group in both the IdP and D.Hub.

Step 2: Sync the group and its members

1. Open the vertical more menu (⋮) on the registered group row.
2. Select Manage members and confirm that the registered OIDC users appear.
3. If the group name changed in the IdP, select Sync on the group row.
4. If a user's group membership changed in the IdP, open System → Settings → Users and select Sync for that user, or ask the user to sign in through SSO again.

Sync on a group row refreshes group information such as its name and deletion state. Membership is refreshed from the IdP when an OIDC user is synchronized or signs in. If one of that user's IdP groups does not exist in D.Hub yet, the synchronization can register it automatically as an OIDC group.

For an OIDC group from a read-only IdP, you cannot add or remove users directly in Manage members. Change the membership in the IdP and then sync the affected user. With a write-capable IdP, changes in Manage members are also written to the IdP.

Step 3: Grant a collection role to the group

1. Open the target collection and select Share & Permissions.
2. Find and select the group you just registered in the user or group search field.
3. Choose the required Reader, Writer, or Owner role and grant access.

The collection role now applies to every registered member of the group. A collection role is the minimum access inherited by resources in that collection. You can grant a higher role on an individual resource, but you cannot reduce access below the inherited collection role there.

If a user cannot see the collection

Check these items in order:

1. Confirm that the OIDC user is registered under System → Settings → Users.
2. Confirm that the OIDC group is registered under System → Settings → Groups.
3. Open Manage members for the group, confirm that the user appears, and sync that OIDC user from the Users page if needed.
4. Open Share & Permissions on the collection and confirm that the group has the intended role.
5. Sign in as the target user and confirm that the collection appears and the required actions are available.

Self-check

• The IdP group appears with an OIDC provider in the D.Hub group list.
• Manage members shows the registered users who belong to the group.
• The collection role granted to the group applies to its members.
• You can explain how membership management differs between read-only and write-capable IdPs.

What you should know after this lesson

• How to register an IdP group without creating a separate name mapping.
• How to sync an OIDC group and its members.
• How to grant a collection role to the registered group.

Next lesson

Create an FGAC policy that limits visible columns and rows for selected users and groups within the same dataset.