docs(enterprise): Add IdP delegation documentation [PLAT-4827]#1416
Open
justinegeffen wants to merge 28 commits into
Open
docs(enterprise): Add IdP delegation documentation [PLAT-4827]#1416justinegeffen wants to merge 28 commits into
justinegeffen wants to merge 28 commits into
Conversation
…[PLAT-4827] Add the conceptual hub page for IdP-delegated Teams and the group catalog documentation set: SCIM provisioning guides for Okta and Entra ID, manual entry guides for Google Workspace and Keycloak, and a catalog overview that covers SCIM push, manual entry, manual-to-SCIM promotion, orphaned-team behavior on group removal, and multi-organization deployment notes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…PLAT-4827] Add per-IdP OIDC and SAML claim configuration guidance for Okta, Entra ID, Keycloak, and Google Workspace. Add the multi-organization routing page covering the topology decision table, the cross-organization group-name uniqueness invariant, and conflict resolution. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…4827] Add a standalone Enterprise Teams page covering Team creation, editing, and the IdP delegation procedure. The delegation section includes prerequisites, the assignment flow, immutability behavior, login-time evaluation, and the conversion path back to manual management. Anchored as #delegate-a-team-to-an-idp-group for cross-references from the authentication docs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… overview [PLAT-4827] Register the new IdP delegation pages and the new orgs-and-teams Teams page in the Enterprise sidebar. Update the authentication overview with a one-line OIDC group-claim note and an "IdP delegation and group claims" section that links to the new sub-folder. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
justinegeffen
added
1. Dev/PM/SME
Member
There was a problem hiding this comment.
First read-through, ping me if you need help or want to clarify something @justinegeffen, happy to help :)
I left lots of comments but a lot of them are repetitions of the same.
|
|
||
| ## Delegate a Team to an IdP group | ||
|
|
||
| Organizations with an active SSO connection can delegate team membership to an identity provider (IdP) group. Once a team is delegated, the IdP becomes the sole authority for who belongs — Seqera evaluates each user's IdP claims at every SSO login and adjusts membership automatically. |
Member
There was a problem hiding this comment.
See comment above, the SSO connection is not required, it's activating OIDC auth that's required instead. cc. @JaimeSeqLabs
Contributor
There was a problem hiding this comment.
Just to clarify here, as OIDC is SSO. I think what @joaquimgamero is getting at is... not a runtime managed SSO connection within the UI (which is restricted to CloudPro), but the env/config managed OIDC SSO connection.
|
|
||
| ### Before you begin | ||
|
|
||
| - An active SSO connection on your organization. See [Authentication](../enterprise/configuration/authentication/overview). |
Member
There was a problem hiding this comment.
Same as above, the requirement is to activate OIDC auth. cc. @JaimeSeqLabs
Comment on lines
+50
to
+53
| 1. From the organization's landing page, open the **Teams** tab. | ||
| 2. Select the team you want to delegate, then **Edit**. | ||
| 3. In the **IdP Group** field, select a group from the dropdown. The dropdown is populated from your organization's IdP group catalog. | ||
| 4. Select **Update** to save. |
Member
There was a problem hiding this comment.
This can only be done via Group Mapping page, not in the team edit page.
Contributor
Author
There was a problem hiding this comment.
@joaquimgamero do we have screenshots or a recording of this? I want to double-check I have all the UI elements/steps documented properly.
Member
There was a problem hiding this comment.
This is why I meant @justinegeffen - this is the only place where you can assign a team to an IdP group
|
|
||
| ## Add the group to Seqera | ||
|
|
||
| 1. In Seqera, open **Organization settings** and select **Manage single sign-on**, then **Group mapping**. |
Contributor
There was a problem hiding this comment.
This would I think be correct for cloud, but not enterprise. As SSO is env/config driven, there is not UI for managing SSO, hence we just have Org setting > Group mapping > 'manage'
Contributor
There was a problem hiding this comment.
this file is inside platform-enterprise_docs directory so I'm guessing this is for enterprise only, we need to fix this
Contributor
|
Just a general comment here on the use of 'catalog'. I think this is claude parlance which has slipped into usage in the code and made it's way to the UI. 
And now in the docs. It's not necessarily a bad thing, just raising that this might not be how we want to refer to a collection of objects in the UI. |
|
|
||
| ## Add the group to Seqera | ||
|
|
||
| 1. In Seqera, open **Organization settings** and select **Manage single sign-on**, then **Group mapping**. |
Contributor
There was a problem hiding this comment.
Same deal as for google wrt form/flow, and presence on team form
|
|
||
| - An active SSO connection on your organization. See [Authentication](../enterprise/configuration/authentication/overview). | ||
| - A populated IdP group catalog. See [Manage your IdP group catalog](../enterprise/configuration/authentication/idp-delegation/group-catalog/overview). | ||
| - An IdP that emits the `groups` claim in OIDC or SAML tokens. See [IdP claim mapping](../enterprise/configuration/authentication/idp-delegation/claim-mapping). |
Contributor
There was a problem hiding this comment.
SAML is not supported yet
|
|
||
| Manual assignments to non-delegated teams are never touched by this evaluation. Users added manually to a team with no **IdP Group** value keep their membership regardless of their IdP claims. | ||
|
|
||
| If the user's token has no `groups` claim or the claim is malformed, Seqera treats it as no group memberships and revokes any delegation-driven team memberships the user previously had. |
Contributor
There was a problem hiding this comment.
Hmm, I believe this isn't aligned with the behaviour, we current treat malformed as absent, hence no removal will happen. Let me double check that.
Contributor
There was a problem hiding this comment.
Yup FR-018:
Malformed claims should be rejected by the SSO layer before reaching evaluation; if they do reach evaluation, treat as absent (skip) to fail safely.
Absent here means no groups claim, no membership change.
Co-authored-by: Nathan Johnson <swingingsimian@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
…on/idp-delegation/overview.md Co-authored-by: Nathan Johnson <swingingsimian@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
…on/idp-delegation/group-catalog/overview.md Co-authored-by: Joaquim Gamero <32884354+joaquimgamero@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
| Google Workspace identifies groups in OIDC tokens by the **group's primary email address**, not its display name. The value you enter in the Seqera catalog must match that email exactly — for example: | ||
|
|
||
| ``` | ||
| nextflow-admins@yourcompany.com |
Contributor
There was a problem hiding this comment.
should we include a screenshot creating a manual group with this ?
|
|
||
| ## Add the group to Seqera | ||
|
|
||
| 1. In Seqera, open **Organization settings** and select **Manage single sign-on**, then **Group mapping**. |
Contributor
There was a problem hiding this comment.
this file is inside platform-enterprise_docs directory so I'm guessing this is for enterprise only, we need to fix this
Comment on lines
+40
to
+44
| 2. Select **Add manual group**. | ||
| 3. In **Group name**, paste the group's email address. | ||
| 4. (Optional) In **Display name**, enter a human-friendly label for the group. This appears in the **IdP Group** dropdown on the team form. | ||
| 6. (Optional) Select a Linked team | ||
| 7. Select **Add**. |
Contributor
There was a problem hiding this comment.
This is likely carried from the outdated spec, there is no display name for the manual groups:
Suggested change
| 2. Select **Add manual group**. | |
| 3. In **Group name**, paste the group's email address. | |
| 4. (Optional) In **Display name**, enter a human-friendly label for the group. This appears in the **IdP Group** dropdown on the team form. | |
| 6. (Optional) Select a Linked team | |
| 7. Select **Add**. | |
| 2. Select **Add manual group**. | |
| 3. In **Group name**, paste the group's email address. | |
| 4. Select a Linked team from the list. | |
| 5. Select **Add**. |
justinegeffen
commented
May 20, 2026
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
Co-authored-by: Jaime Muñoz Redondo <105782439+JaimeSeqLabs@users.noreply.github.com> Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
justinegeffen
commented
May 20, 2026
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
justinegeffen
commented
May 20, 2026
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
justinegeffen
commented
May 20, 2026
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
justinegeffen
commented
May 20, 2026
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
justinegeffen
commented
May 20, 2026
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
Removed deprecated items from the enterprise sidebar. Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
Member
christopher-hakkaart
left a comment
christopher-hakkaart
left a comment
There was a problem hiding this comment.
I've made lots of editorial suggestions. There is one place where it looks like a merge conflict has been carried through. Everything is marked as suggestions, please check that the meaning is retained.
| tags: [sso, scim, idp-delegation, administration, enterprise] | ||
| --- | ||
|
|
||
| Seqera maintains a per-organization catalog of identity provider (IdP) groups. The catalog is independent of user activity and groups appear as soon as they're synced or entered, before any user has signed in. |
Member
There was a problem hiding this comment.
Suggested change
| Seqera maintains a per-organization catalog of identity provider (IdP) groups. The catalog is independent of user activity and groups appear as soon as they're synced or entered, before any user has signed in. | |
| Seqera maintains a per-organization catalog of identity provider (IdP) groups. Groups appear in the catalog as soon as they're synced from the IdP or added manually. They don't depend on any user having signed in. |
Comment on lines
+17
to
+23
| :::info | ||
| Other identity providers | ||
|
|
||
| SCIM provisioning is officially supported with Okta and Microsoft Entra ID. Any OIDC or SAML identity provider can authenticate users through Auth0, but group membership won't sync automatically and lifecycle events (joiners, movers, leavers) need to be handled manually in Seqera. | ||
|
|
||
| If you use Google Workspace, Keycloak, Ping, OneLogin, or another OIDC/SAML provider and want to delegate team membership, contact your Seqera account team to discuss your setup. | ||
| ::: |
Member
There was a problem hiding this comment.
Suggested change
| :::info | |
| Other identity providers | |
| SCIM provisioning is officially supported with Okta and Microsoft Entra ID. Any OIDC or SAML identity provider can authenticate users through Auth0, but group membership won't sync automatically and lifecycle events (joiners, movers, leavers) need to be handled manually in Seqera. | |
| If you use Google Workspace, Keycloak, Ping, OneLogin, or another OIDC/SAML provider and want to delegate team membership, contact your Seqera account team to discuss your setup. | |
| ::: | |
| :::info[Other identity providers] | |
| SCIM-based provisioning is supported for Okta and Microsoft Entra ID. With these providers, group membership syncs automatically, including lifecycle events (joiners, movers, leavers). | |
| Other OIDC or SAML identity providers can authenticate users through Auth0, but group membership doesn't sync automatically. An admin must update memberships in Seqera as users join, move, or leave. | |
| If you use Google Workspace, Keycloak, Ping, OneLogin, or another OIDC/SAML provider and want to delegate team membership, contact your Seqera account team to discuss your setup. | |
| ::: |
I found this unclear, please check meaning is retained. Note that even if the content is incorrect, I've moved the title to be the title of the admonition.
Comment on lines
+44
to
+52
| 1. Open **Organization settings** and select **Group mapping**. | ||
| 2. Select **Add manual group**. | ||
|
|
||
| To add a group manually: | ||
|
|
||
| To delete a manually-entered group, select **Delete** on its row. If any delegated team references the group, its members are immediately purged. | ||
| 2. Select **Add group manually**. | ||
| 3. Enter the group identifier exactly as it appears in your IdP's `groups` claim. | ||
| 4. Select **Save**. |
Member
There was a problem hiding this comment.
Suggested change
| 1. Open **Organization settings** and select **Group mapping**. | |
| 2. Select **Add manual group**. | |
| To add a group manually: | |
| To delete a manually-entered group, select **Delete** on its row. If any delegated team references the group, its members are immediately purged. | |
| 2. Select **Add group manually**. | |
| 3. Enter the group identifier exactly as it appears in your IdP's `groups` claim. | |
| 4. Select **Save**. | |
| To add a group manually: | |
| 1. Open **Organization settings** and select **Group mapping**. | |
| 2. Select **Add group manually**. | |
| 3. Enter the group identifier exactly as it appears in your IdP's `groups` claim. | |
| 4. Select **Save**. |
Please check this is correct.
There were two steps:
- Select Add group manually.
- Select Add manual group.
And the text below was injected.
| To delete a manually-entered group, select **Delete** on its row. If any delegated team references the group, its members are immediately purged and a warning indicates that the team has lost its source of membership. | ||
|
|
||
| :::info | ||
| A manually-entered group is automatically promoted to SCIM-managed if your IdP later pushes the same group via SCIM. The promotion happens in place; the catalog row is reused, and any delegated teams that reference it continue to work without interruption. After promotion, the row's lifecycle is fully driven by SCIM, and the manual **Delete** action is no longer available; the row is removed when your IdP issues a SCIM `DELETE`. |
Member
There was a problem hiding this comment.
Suggested change
| A manually-entered group is automatically promoted to SCIM-managed if your IdP later pushes the same group via SCIM. The promotion happens in place; the catalog row is reused, and any delegated teams that reference it continue to work without interruption. After promotion, the row's lifecycle is fully driven by SCIM, and the manual **Delete** action is no longer available; the row is removed when your IdP issues a SCIM `DELETE`. | |
| A manually-entered group is automatically promoted to SCIM-managed if your IdP later pushes the same group via SCIM. The promotion happens in place. The catalog row is reused, and any delegated teams that reference it continue to work without interruption. After promotion, the row's lifecycle is fully driven by SCIM, and the manual **Delete** action is no longer available. The row is removed when your IdP issues a SCIM `DELETE`. |
| When a group is removed from the catalog, by SCIM `DELETE`, manual deletion, or IdP-side rename detection, the following happens asynchronously: | ||
|
|
||
| - The catalog row is removed. | ||
| - Every delegated team that referenced the group has its delegation-driven members purged. The team's other settings — name, workspace assignments, role — are preserved. |
Member
There was a problem hiding this comment.
Suggested change
| - Every delegated team that referenced the group has its delegation-driven members purged. The team's other settings — name, workspace assignments, role — are preserved. | |
| - Every delegated team that referenced the group has its delegation-driven members purged. The team's other settings (name, workspace assignments, role) are preserved. |
Comment on lines
+54
to
+56
| - **Match found** — the user is added to the team if they aren't already a member. | ||
| - **No match** and the user was previously a member — they're removed from the team. | ||
| - **No match** and the user was never a delegation-driven member — no change. |
Member
There was a problem hiding this comment.
Suggested change
| - **Match found** — the user is added to the team if they aren't already a member. | |
| - **No match** and the user was previously a member — they're removed from the team. | |
| - **No match** and the user was never a delegation-driven member — no change. | |
| - **Match found**: The user is added to the team if they aren't already a member. | |
| - **No match and the user was previously a member**: The user is removed from the team. | |
| - **No match and the user was never a delegation-driven member**: no change. |
| - Each delegation-driven membership change at login produces a `team_member_added` or `team_member_removed` event. | ||
| - Group catalog operations produce `idp_group_created`, `idp_group_updated`, and `idp_group_deleted` events so you can correlate catalog changes with downstream membership changes. | ||
|
|
||
| SCIM-originated entries — operations performed by your IdP's provisioning agent against Seqera's SCIM endpoint — are attributed to a **System** operator rather than to a named administrator, because they authenticate with a SCIM bearer token. To correlate a SCIM event with a specific administrator action, match by `displayName` and timestamp against your IdP's provisioning logs. |
Member
There was a problem hiding this comment.
Suggested change
| SCIM-originated entries — operations performed by your IdP's provisioning agent against Seqera's SCIM endpoint — are attributed to a **System** operator rather than to a named administrator, because they authenticate with a SCIM bearer token. To correlate a SCIM event with a specific administrator action, match by `displayName` and timestamp against your IdP's provisioning logs. | |
| SCIM-originated entries (operations performed by your IdP's provisioning agent against Seqera's SCIM endpoint) are attributed to a **System** operator rather than to a named administrator, because they authenticate with a SCIM bearer token. To correlate a SCIM event with a specific administrator action, match by `displayName` and timestamp against your IdP's provisioning logs. |
| Complete these steps in order. Each step links to a dedicated guide. | ||
|
|
||
| 1. [Configure authentication](../overview) for your Enterprise instance if you haven't already. | ||
| 2. [Populate the IdP group catalog](./group-catalog/overview) — choose SCIM push or manual entry depending on your IdP. |
Member
There was a problem hiding this comment.
Suggested change
| 2. [Populate the IdP group catalog](./group-catalog/overview) — choose SCIM push or manual entry depending on your IdP. | |
| 2. [Populate the IdP group catalog](./group-catalog/overview). Choose SCIM push or manual entry depending on your IdP. |
| 3. Update the **Name**, **Description**, **Avatar**, or membership. | ||
| 4. Select **Update** to save. | ||
|
|
||
| The same surface is used to delete a team. The **Delete** action is disabled for delegated teams; clear the **IdP Group** field first. |
Member
There was a problem hiding this comment.
Suggested change
| The same surface is used to delete a team. The **Delete** action is disabled for delegated teams; clear the **IdP Group** field first. | |
| The same surface is used to delete a team. The **Delete** action is disabled for delegated teams. Clear the **IdP Group** field first. |
| - An active OIDC SSO connection on your organization. See [Authentication](../enterprise/configuration/authentication/overview). | ||
| - A populated IdP group catalog. See [Manage your IdP group catalog](../enterprise/configuration/authentication/idp-delegation/group-catalog/overview). | ||
| - An IdP that emits the `groups` claim in OIDC tokens. See [IdP claim mapping](../enterprise/configuration/authentication/idp-delegation/claim-mapping). | ||
| - Organization owner access to your Seqera organization. |
Member
There was a problem hiding this comment.
Suggested change
| - Organization owner access to your Seqera organization. | |
| :::info[**Prerequisites**]{#prerequisites} | |
| You will need the following to get started: | |
| - An active OIDC SSO connection on your organization. See [Authentication](../enterprise/configuration/authentication/overview). | |
| - A populated IdP group catalog. See [Manage your IdP group catalog](../enterprise/configuration/authentication/idp-delegation/group-catalog/overview). | |
| - An IdP that emits the `groups` claim in OIDC tokens. See [IdP claim mapping](../enterprise/configuration/authentication/idp-delegation/claim-mapping). | |
| - Organization owner access to your Seqera organization. | |
| ::: |
Member
christopher-hakkaart
left a comment
christopher-hakkaart
left a comment
There was a problem hiding this comment.
I've made lots of editorial suggestions. There is one place where it looks like a merge conflict has been carried through. Everything is marked as suggestions, please check that the meaning is retained.
Member
|
fix formatting |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Customer-facing documentation for PLAT-4827 — IdP delegation & claims mapping on Seqera Platform Enterprise, shipping with the v26.1 release. Targets the `enterprise-26.1-documentation` branch so this content flows into the 26.1 versioned docs.
This PR adds the documentation layer that explains how organization owners can map a Seqera Team to an IdP group, populate the group catalog (SCIM or manual), configure the IdP to emit the `groups` claim, and understand multi-organization routing.
Pages added
Under platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/:
Plus a new Teams page (created from scratch — Enterprise didn't have one):
Pages updated
AC coverage (PLAT-4827)
Out of scope
Open questions for product/engineering
Reviewers
CODEOWNERS will auto-request docs reviewers. Please also add:
Test plan
Companion Cloud PR: #1415 against `master`.
🤖 Generated with Claude Code