Docs Menu

Manage Mapping Atlas Roles to IdP Groups

On this page

You can map your IdP groups to Atlas roles. This streamlines authorization setup. You can grant one IdP group one or more roles to simplify their access to Atlas organizations, projects, and clusters.

Note

You can't edit roles for specific users on the Access Manager page if you configure role mappings for IdP groups.

  1. Atlas applies the role mappings when you log in.
  2. Atlas compares the IdP groups named memberOf to role mappings defined for your organizations. These organizations must use the same IdP that the user did to authenticate.

To complete this tutorial, you must have:

  • Created an IdP application. This application must have a SAML attribute named to memberOf. Map this attribute to the IdP source attributes for groups. This attribute links the IdP groups with your Atlas roles.
  • Linked an IdP to Atlas.
  • Mapped an Atlas organizations to your IdP.
  • Created at least one group in your IdP.
  • Add at least one user in your IdP application to a group you created.
1
  1. Log in to Atlas.
  2. Use the dropdown at the top-left of Atlas to select the organization for which you want to manage federation settings.
  3. Click Settings in the left navigation pane.
  4. In Manage Federation Settings, click Visit Federation Management App.
2
  1. Click Manage Organizations.

    Atlas displays all organizations where you are an Organization Owner in a table.

    • Organizations connected to federated authentication display in the Actions column.
    • Organizations unconnected to federated authentication display Connect in the Actions column.
  2. To map roles in an organization:

    1. Click Connect to enable federated authentication for that organization if needed.
    2. Click and select View.
3
  1. Click Create Role Mappings.

    Atlas displays the Organization Role Mappings page.

  2. Click Create A Role Mapping.

    Atlas displays the Create Role Mapping For Your Users page.

4

At the Map Group and Assign Roles stage:

Section
Action
Enter Group Name

Type the name of the group as it is displayed in your IdP in this field. Atlas assigns this group to your Atlas role.

Note

If the IdP group doesn't exist, you can't enter a new group name to create a new IdP group.

Assign Organization Roles
Click on each Atlas organization role that you want to assign to the IdP group.
  • If you don't need to assign any Atlas project roles to this IdP group, click Finish. You can skip the rest of this procedure.
  • If you need to assign Atlas project roles to this IdP group, click Next.
5

The Assign Project Roles stage displays a table. This table includes project names and the roles you can assign for those projects. For each project, click the project roles that you want to assign to the IdP group.

  • If you don't need to review the roles assigned to this IdP group, click Finish. You can skip the rest of this procedure.
  • If you need to review the roles assigned to this IdP group, click Next.
6

The Review and Confirm stage displays the organization and project roles assigned to the IdP group.

  • If you agree with the roles assigned to this IdP group, click Finish.
  • If you need to change the roles assigned to this IdP group, click . Atlas returns to the Map Group and Assign Roles stage.
1
  1. Log in to Atlas.
  2. Use the dropdown at the top-left of Atlas to select the organization for which you want to manage federation settings.
  3. Click Settings in the left navigation pane.
  4. In Manage Federation Settings, click Visit Federation Management App.
2
  1. Click Manage Organizations.

    Atlas displays all organizations where you are an Organization Owner in a table.

  2. Click next to the desired IdP Group Name and select View.
3
  1. Click Create Role Mappings.

    Atlas displays the Organization Role Mappings page.

  2. Click to the right of the IdP group you want to change.

    Atlas displays the Edit Your Role Mapping For This Organization page.

4

At the Map Group and Assign Roles stage:

Section
Action
Enter Group Name

Type the name of the group as it is displayed in your IdP in this field. Atlas assigns this group to your Atlas role.

Note

If the IdP group doesn't exist, you can't enter a new group name to create a new IdP group.

Assign Organization Roles
Click on each Atlas organization role that you want to assign to the IdP group.
  • If you don't need to assign any Atlas project roles to this IdP group, click Finish. You can skip the rest of this procedure.
  • If you need to assign Atlas project roles to this IdP group, click Next.
5

The Assign Project Roles stage displays a table. This table includes project names and the roles you can assign for those projects. For each project, click the project roles that you want to assign to the IdP group.

  • If you don't need to review the roles assigned to this IdP group, click Finish. You can skip the rest of this procedure.
  • If you need to review the roles assigned to this IdP group, click Next.
6

The Review and Confirm stage displays the organization and project roles assigned to the IdP group.

  • If you agree with the roles assigned to this IdP group, click Finish.
  • If you need to change the roles assigned to this IdP group, click . Atlas returns to the Map Group and Assign Roles stage.
1
  1. Log in to Atlas.
  2. Use the dropdown at the top-left of Atlas to select the organization for which you want to manage federation settings.
  3. Click Settings in the left navigation pane.
  4. In Manage Federation Settings, click Visit Federation Management App.
2
  1. Click Manage Organizations.

    Atlas displays all organizations where you are an Organization Owner in a table.

    • Organizations connected to federated authentication display in the Actions column.
    • Organizations unconnected to federated authentication display Connect in the Actions column.
  2. To map roles in an organization:

    1. Click Connect to enable federated authentication for that organization if needed.
    2. Click and select View.
3
  1. Click Create Role Mappings.

    Atlas displays the Organization Role Mappings page.

  2. Click to the right of the IdP group you want to remove.

    Atlas displays the Delete role mappings for this group modal.

  3. Click Delete to remove all role mappings from this IdP group.

    If you don't want to remove all role mappings, click Cancel.

Give Feedback
© 2021 MongoDB, Inc.

About

  • Careers
  • Legal Notices
  • Privacy Notices
  • Security Information
  • Trust Center
© 2021 MongoDB, Inc.