SSO group mapping gives each SSO user the right Portfolio access automatically, based on the groups they belong to in your identity provider. Your IT team keeps managing team membership in one place, and Digital Showroom places each user in the matching User Groups every time they sign in. You never have to add SSO users to User Groups by hand.

For example, Northwind Supplies has a group called DS-Sales-EMEA in its identity provider. The Digital Showroom administrator maps it to the Sales EMEA User Group, which has access to the EMEA Portfolio. When the IT team adds a new sales representative to DS-Sales-EMEA, that person sees the EMEA Portfolio at their first sign-in, without anyone touching Digital Showroom.

This article is for two people: the identity provider administrator in your IT team (part 1) and the Digital Showroom administrator (parts 2 and 3).

Before you start

• SSO is set up and the connection shows the Activated status. See Set up SSO.
• You have the Administrator role in Digital Showroom. Administrators can change a user's role in Admin > User management.
• Someone in your IT team has administrator access to your identity provider.
• Your User Groups exist and have their Portfolios. See Manage User Groups.

Group mapping is self-serve: you do not need to contact Akeneo to set it up.

How SSO group mapping works

1. When a user signs in with SSO, your identity provider sends the list of groups they belong to.
2. Digital Showroom compares each group name with the SSO groups you mapped to your User Groups.
3. The user is added to every User Group that has a matching SSO group, and removed from the User Groups that no longer match.
4. The user can access all the Portfolios of their User Groups.

A user can belong to several groups in your identity provider, and you can map several SSO groups to the same User Group. The user gets the Portfolios of all their matching User Groups.

Group mapping only manages User Groups. It never changes a user's role: new SSO users start with the User role, and an administrator can change it in Admin > User management.

When changes apply

Part 1: send group information from your identity provider

For your IT team. Digital Showroom can only map the groups your identity provider sends at sign-in. Configure your SSO application so that every sign-in includes the user's groups.

What Digital Showroom expects

• A list of groups for each user. Your identity provider must include the groups the user belongs to in the information it sends at sign-in: a groups attribute in the SAML assertion, or a groups claim in the OpenID Connect token.
• Readable group names. Digital Showroom matches the exact text it receives. Send names your Digital Showroom administrator can recognize and type, such as DS-Sales-EMEA, rather than technical identifiers.
• Only the groups you need. If your users belong to many groups, filter the list so that it only contains the groups used for Digital Showroom, for example all groups whose name starts with DS-. This keeps the list short and easy to check.

Share the exact group names with your Digital Showroom administrator, with the same upper and lower case.

Examples for common identity providers

The exact menus depend on your identity provider and change over time. Use these points as general guidance and follow your provider's documentation for the detailed steps.

• Microsoft Entra ID: add a groups claim to the Digital Showroom enterprise application. By default, Entra ID sends group object IDs (long identifiers such as 3f2b...) rather than group names. If you keep object IDs, your Digital Showroom administrator must map the IDs, not the names. Where your setup allows it, send group names instead, and limit the claim to the groups assigned to the application.
• Okta: add a groups attribute statement (SAML) or a groups claim (OpenID Connect) to the Digital Showroom application, with a filter that keeps only the relevant groups, for example names starting with DS-.
• Other providers: add an attribute or claim that contains the names of the user's groups, and make sure it is sent for every user who signs in to Digital Showroom.

Part 2: map groups in Digital Showroom

For the Digital Showroom administrator. You can map SSO groups for all your User Groups at once from the Single Sign-On page, or for one User Group from its own page. Both show the same mappings: a change saved in one place appears in the other.

Check that SSO group mapping is on

1. Go to Admin > User management > Single Sign-On.
2. Check that the SSO group mapping switch is on. It is on by default.

When the switch is on, the User Groups of SSO users follow your mappings, and you cannot add or remove SSO users manually in a User Group. When it is off, the mapping section is hidden and you manage SSO users' groups by hand. To learn what happens when you turn the switch on or off, see Set up SSO.

Map groups for all User Groups

1. Go to Admin > User management > Single Sign-On.
2. In User group mapping, find the User Group in the Digital Showroom user group column. Use the search bar if needed.
3. In the SSO user groups column, enter the group name exactly as your identity provider sends it.
4. To map another SSO group to the same User Group, click Add a group and enter the name.
5. Click Save.

If the User Group you need does not exist yet, click New user group to create it.

Map groups from a User Group

1. Go to Admin > User management > User groups.
2. Click the group's row.
3. In SSO Group mapping, type the group name exactly as your identity provider sends it, and press Enter. Repeat for each group.
4. Click Save.

You can also fill SSO Group mapping when you create a User Group. In that case, users who already signed in get the new group at their next SSO sign-in.

Matching rules

• Exact match only. DS-Sales-EMEA, ds-sales-emea, and DS-Sales are three different groups. There are no wildcards or partial matches.
• Upper and lower case count. Copy the name from your identity provider rather than typing it from memory.
• No extra spaces. A space before or after the name prevents the match.
• Same text as sent. If your identity provider sends group IDs instead of names, map the IDs.

Remove a mapping

1. Go to Admin > User management > Single Sign-On.
2. In User group mapping, clear the name of the SSO group. If the User Group has several SSO groups, you can click the trash icon next to the one to remove instead.
3. Click Save.

Users who got the User Group only through this SSO group are removed from it right away, and lose access to its Portfolios unless another of their User Groups has them. You can also remove a group from the SSO Group mapping field on the User Group page.

Part 3: test and troubleshoot

Test with one user

1. Ask a test user who belongs to a mapped group in your identity provider to sign in to Digital Showroom with SSO.
2. Go to Admin > User management and click the user's row.
3. Check the SSO group mapping table on the User details page.

The table lists the groups your identity provider sent at the user's last sign-in, with, for each one, the Mapped Digital Showroom Group and the Associated Portfolio. A group shown as Not mapped matches none of your mappings.

Common issues

Related articles

• Set up SSO
• Manage User Groups
• Manage users
• Log in to Digital Showroom