Early Access
Mapping Rules as part of both Just-In-Time user onboarding (JIT), and System for Cross-domain Identity Management (SCIM) for Akeneo Product Cloud is available in Early Access, on request, to Premium customers only. Contact Akeneo to request access.
Map Identity Provider (IdP) groups to PIM Roles and User Groups
Use mapping rules to assign the appropriate PIM Roles and User Groups when someone signs in through your Identity Provider (IdP), either through Just-In-Time (JIT) user onboarding or via System for Cross-domain Identity Management (SCIM), both with SSO (Single Sign-On).
To understand Akeneo user provisioning Premium features, refer to Set up Just-In-Time (JIT) user onboarding with SSO (Single Sign-On) or Set up automatic user provisioning with System for Cross-domain Identity Management (SCIM) articles.
Your PIM administrator needs the System > Manage the Single Sign-On (SSO) user role permission.
Map IdP groups to PIM access
Use Mapping rules to assign PIM Roles and User Groups from the groups your IdP sends: the groups claimed at sign-in, or the groups provisioned through SCIM.
You need View IdP permission mapping user Role permission to view the rules and Edit IdP permission mapping permission to edit them. If you cannot access them, contact your PIM administrator or refer to the Manage the interface and actions access article.
- Go to System > Authentication.
- In Mapping rules, click Add rule to add one, and Delete to remove one.
- Enter an operator, and a value.
- Select the Roles and User Groups to assign.
- Click Save. Test the rules with a sign-in through your IdP, or, with SCIM, by running on-demand provisioning for a test person, then check Mapping activity.
Group names containing commas are not supported. Send only groups that are relevant to PIM access, because very large group lists can exceed token size limits and prevent sign-in.
Write effective mapping rules
Start with a small set of rules that cover each user population. For example, a rule can match an Editors group and assign the appropriate PIM Role and User Group. Create a separate rule for administrators, then test both rules with representative IdP users.
Each rule has: Operator, IdP Group, Assign PIM User roles permissions, Assign PIM User groups permissions.
| Operator | Meaning |
|---|---|
| Is member of | The user belongs to an IdP group whose name is exactly the value, case included. |
| always (all users) | Applies to every user. The rule applies to everyone who signs in through the IdP or is provisioned. |
How rules are applied
- Rules run at every SSO sign-in through your IdP and at every change pushed by SCIM. A sign-in with the Akeneo Product Cloud password carries no IdP groups and is never mapped.
- When several rules match, their Roles and User Groups add up.
- The All User Group in the PIM is always kept.
- Rules only remove what they granted. Roles and User Groups assigned by hand in the PIM are never removed. A user removed from every mapped group keeps what the PIM assigned, and gets the User Role if nothing is left.
- While Enable permission mapping rules is off, the rules are still evaluated and traced in Mapping activity as a dry-run, without changing anyone's access. Use it to check your rules before enabling them.
Good to know
- Limits: 50 rules, 20 Roles/User Groups per rule, 255 characters per field.
- Only existing PIM Roles and User Groups can be selected. A Role or User Group deleted later is skipped at sign-in.
- Akeneo PIM cannot list the groups available in your IdP; you type the group names. Enter the group names exactly as your IdP sends them.
- If you rename a group in your IdP, update the rule: the change applies at each person's next sign-in or SCIM change.
- The Mapping activity section lists the last 100 applications of the rules, with the date, the user, the IdP groups received, and the Roles and User Groups granted or taken back. Rows are prefixed [login] for sign-ins and [provisioning] for SCIM changes. Download activity exports them to CSV. Entries are kept for 30 days.