IMPORTANT
Once you have configured an OIDC Group Name for a piplanning.io Team you can only manage the Team via the Identity Provider (IdP).
To add or remove Users manually, clear the OIDC Group Name field first.
What OIDC Group to piplanning.io Team mapping does:
With OIDC Group Mapping the following functionality is provided with the User login and authentication process:
Users are automatically added or removed to the corresponding piplanning.io Team during the [Users] login process.
Your Identify Provider (IdP) becomes the single source of truth in this configuration.
Prerequisites for setting up OIDC Group Mappings
Ensure the IdP (providing the OIDC connection) returns a Group claim. Adjust the scope in the OIDC configuration in the RTE Cockpit > SSO if necessary. Links to help articles to help with the set up for both Okta and Entra ID can be found below.
Mapping Okta Groups
For Okta: A detailed guide for allowing Okta Group to be read by piplanning.io is below. Ensure you complete the OIDC configuration to enable piplanning.io to read the Okta Groups. This Help Article to set up and enable Okta Groups to be read by piplanning.io is a very useful guide.
Mapping Entra ID Groups
For Microsoft Entra ID: please refer to this help article .
NOTE
Group mapping is currently supported for Okta and Microsoft's Entra ID.
Allowing Groups to be read by piplanning.io
In the RTE Cockpit, navigate to Organization > Teams
Edit the Team that you want to map to an OIDC Group
Open the OpenID Connect Group tab under the Add members section
Enter the Group Name: Type in the Group Name from the IdP (Okta or Entra ID) into the Group Name field. *Note: Group Names are case sensitive.
Assign a piplanning.io Role in the Group Role field.
Do this to specify the default [piplanning.io] Role that will be assigned to all Users, of that Okta Group / Team mapping, during login.
IMPORTANT
OIDC Group Names are case-sensitive
By following these steps, Users in the specific OIDC Groups will be automatically added to the respective Team, and assigned the respective Role upon login to piplanning.io.
piplanning.io Role Handling with OIDC Group Mappings
piplanning.io Roles are global across the platform. For instance, if a user is part of multiple teams with different roles—like Member for Team A and Observer for Team B—they will be assigned the highest privilege role available (in this case, Member).
Example of piplanning.io Teams and Role mapping to OIDC Groups
An in-depth example is provided to clarify how teams and role mapping operate when integrating with an IDP. Please click on the image to enlarge.
