Groups Mapping

Group mapping lets you automatically provision permissions, read-only or admin, for your members (both internal and external) based on the groups attribute that your identity provider sends.

It's especially useful for enterprise organizations with a large number of members across multiple projects who need those members automatically routed to the right project with the right permissions.

Within the group mapping controls, you'll configure three fields:

For example: you want users with the group attribute X to have access to project Y, with permission Z.

Mappings Setup

1. Make sure you have a SAML implementation set up in your ReadMe enterprise parent project.
2. Set Group Name to a group that matches the group name in your SAML application in your IdP. For instance, if you have a group named contractors and want members of that group to have access to a project, set Group Name to contractors. Group names are case-sensitive, so double-check the casing.
3. Specify which projects to give them access to. To give access to all projects, set the project to the parent project.
4. Specify which permission they'll receive: read-only or admin.

Example Setup in Okta

In the Attributes & Claims section of your Okta application's SAML settings, add the following mapping:

If you have an Okta SAML connection, you must send us all of your groups. Setting the filter value to .+ does this.

Users map to these groups automatically, if they belong to them.

Mapping Behavior

If you manually overwrite a user's permission, that overwrite takes precedence over the group mapping. ReadMe checks whether a user already has permissions assigned, and if they do, the mapping won't overwrite them.

Group mappings also make the Members section easier to navigate. If a project has a large number of members, mappings collapse users who share the same permissions into a single row.