Skip to content
This repository has been archived by the owner on Jul 5, 2023. It is now read-only.

Commit

Permalink
Update content/cloud-docs/users-teams-organizations/single-sign-on/in…
Browse files Browse the repository at this point in the history
…dex.mdx

Co-authored-by: Laura Pacilio <83350965+laurapacilio@users.noreply.github.com>
  • Loading branch information
JarrettSpiker and laurapacilio committed Apr 8, 2022
1 parent d863b4b commit d7d8a48
Showing 1 changed file with 2 additions and 2 deletions.
Expand Up @@ -74,9 +74,9 @@ To enable team membership mapping:

When team management is enabled, you can configure which SAML attribute in the SAMLResponse will control team membership. This defaults to the `MemberOf` attribute. The expected format of the corresponding AttributeValue in the SAMLResponse is a either a string containing a comma-separated list of teams, or separate AttributeValue items specifying teams.

When team membership management is enabled, users logging in via SAML are automatically added to the teams included in their assertion, and automatically removed from any teams that _aren't_ included in their assertion. This overrides any manually set team memberships; whenever the user logs in, their team membership is adjusted to match their SAML assertion.
When users log in through SAML, Terraform automatically adds them to the teams included in their assertion and automatically removes them from teams that are not included in their assertion. This automatic mapping overrides any manually set team memberships. Each time the user logs in, their team membership is adjusted to match their SAML assertion.

Any team names that don't match existing teams are ignored; Terraform Cloud will not automatically create new teams. If the chosen SAML attribute is not provided in the SAMLResponse, users are assigned to a default team named `sso` and are not removed from any existing teams.
Terraform Cloud ignores team names that do not exactly match existing teams and will not create new teams from those listed in the assertion. If the chosen SAML attribute is not provided in the SAMLResponse, Terraform assigns users to a default team named `sso` and does not remove them from any existing teams.

It is not possible to assign users to the `owners` team through this attribute.

Expand Down

0 comments on commit d7d8a48

Please sign in to comment.