When you configure SSO for the Konnect platform and Dev Portal, you have the option to configure team mappings from your IdP as well. Team mappings allow you to map teams from your IdP to Konnect Org teams and Dev Portal teams.
After you configure Konnect SSO settings in your IdP, you can configure team mappings with the following:
When you configure team mappings for the Konnect org, keep the following in mind:
- You must have at least one group mapped to save configuration changes.
- To manage user and team memberships in Konnect from the Organization settings, enable Konnect team mapping. If you enable this, onboarding new users is a two step process. New users logging in to Konnect with their IdP credentials will get an access error and Konnect administrators will need to map the new user to a valid team before the user is granted access.
- To assign team memberships by the IdP during SSO login via group claims mapped to Konnect teams, enable Identity provider mapping and enter your IdP groups in the relevant fields.
Once team mappings are set up:
- IdP users belonging to the mapped groups can log in to Konnect.
- When a user logs into Konnect with their IdP account
for the first time, Konnect automatically provisions an account with the
relevant roles.
- If your org already has non-admin Konnect users before
mapping, on their next login they will be mapped to the teams defined by their IdP group membership.
- An organization admin can view all registered users in
Konnect, but cannot edit their team membership from the Konnect side. To
manage automatically-created users, adjust user permissions through the IdP, or adjust the team mapping.
Any changes to the mapped IdP groups on the IdP side are reflected in
Konnect. For example:
- Removing a user from a group in the IdP also deactivates their
Konnect account.
- Moving a user from one group to another changes their team in Konnect
to align with the new group-to-team mapping.
When IdP mapping is enabled, team memberships are synced from your IdP for every Konnect team by default.
You can exclude specific teams from IdP synchronization to manage their membership manually in Konnect, even while mapping is enabled for the rest of your teams.
This is useful when you are migrating from one IdP to another, or if admins don’t have access to the IdP settings and need to create some teams manually.
The team list is available only when OIDC or SAML is configured and enabled for your org.
- In the Konnect sidebar, click your organization name and click Manage organization.
- Click the Settings tab.
- Click the Team mappings tab.
- In the Identity provider mapping section, find the team in the list.
- Disable Active next to the team you want to exclude from IdP synchronization.
Set konnect_managed on the team by sending a PATCH request to the /teams/{teamId} endpoint.
You can also set it when you create a team with the /teams endpoint.
curl -X PATCH "https://us.api.konghq.com/v3/teams/$TEAM_ID" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN" \
--json '{
"konnect_managed": true
}'
If IdP mapping is enabled and a team is active but no IdP group is mapped to it, Konnect treats the team as an empty IdP group. Users are removed from the team at their next login, even if they were added manually in Konnect. To manage a team’s membership manually, disable Active for that team.