> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/settings/configuration/teams/oidc-group-mapping.md).

# Configure OIDC group mapping

Configure OIDC group mapping to automatically assign Traceable roles and scopes based on OIDC claims during SSO.

OIDC group mapping enables you to assign Traceable roles to users automatically, based on the claim information your OIDC provider sends during single sign-on. Instead of assigning roles to each user manually, you map an OIDC claim to one or more Traceable roles, and Traceable applies those roles whenever a user signs in through that claim name.

{% hint style="info" %}
OIDC group mapping is currently available only for on-prem customers.
{% endhint %}

## What you will learn from this topic

By the end of this topic, you will be able to:

* Understand how OIDC group mapping assigns Traceable roles to users based on OIDC claims.
* Configure an OIDC group mapping and assign one or more Traceable roles and scopes to the group.

***

## Before you begin

Before you proceed to configure an OIDC group mapping, make a note of the following:

* Make sure you are the *Account Owner* or have the necessary *Edit* permissions at the Team level.
* Make sure that OIDC authentication is configured for your account. For more information, see [Authentication and Users](/web-application-and-api-protection-waap/settings/configuration/teams/authentication-and-users.md).
* Make sure that you know which Traceable roles and scopes you want to assign to the group.
* Make sure that you know the exact claim name your identity provider uses to send group information.

***

## Configure an OIDC group mapping

You can create an OIDC group mapping by navigating to **Settings → Team → SSO Config** tab, and clicking **+ Add group**. To configure an OIDC group mapping, complete the following steps:

<figure><img src="https://1414883571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdr7UJpJrdGkkSGT6AFTu%2Fuploads%2FjnJ8QqrrZDuXm0Z2dK3C%2FTraceable_team_SSO_OIDC.png?alt=media&amp;token=ec10d66a-e405-4fa6-9bdb-d320b34a43c4" alt=""><figcaption></figcaption></figure>

OIDC group mapping automatically assigns Traceable roles to users based on the groups your identity provider assigns them when your organization authenticates via OIDC. Configuring this mapping removes the need to manually assign a role to every user who logs in through SSO.

***

## Create an OIDC group mapping

To create an OIDC group mapping, complete the following steps:

<figure><img src="https://1414883571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdr7UJpJrdGkkSGT6AFTu%2Fuploads%2FyzpqMXBd2aAh6b73i18d%2FTraceable_team_sso_config_oidc.png?alt=media&amp;token=51a19abf-e4e0-444c-a161-14d5835029d6" alt=""><figcaption></figcaption></figure>

1. Click **+ Add group**.
2. In the opened slide-out panel, **Map Group to Roles**, from the **Type** dropdown, select **OIDC**.
3. In the **OIDC Group Attribute/Claim Name** field, specify the exact claim name configured on your identity provider, for example, `OIDC_group_mapping`.
4. In the **OIDC Group** name field, specify the exact group name as it exists in your identity provider, for example, `Sample OIDC Group`.
5. Click **Add Role**.
6. From the **Role** dropdown, select the Traceable role to assign, for example, `Developer`.
7. From the **Scope** dropdown, select the scope the role applies to according to your requirements.

***

## Remove a group mapping

1. Navigate to **Settings → Team → SSO Config** tab.
2. Locate the group mapping row you want to remove, and click the ellipsis (**…**) icon, or open the mapping and click **Remove Group**.

{% @harness-feedback/feedback %}