> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.metalocator.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Mapping user groups and types with SSO

Attribute mappings can be specified in an SSO platform, which can be used to designate the target User Type and User Groups used when users are created on-the-fly via SSO.

This allows new SSO-created users to be created within the desired [User Group and and also be of the desired User Type](https://support.metalocator.com/en/articles/4055240-group-permissions#terminology).

Before implementing steps in this article, be sure a functioning [SSO configuration has been established](https://support.metalocator.com/en/?q=sso) between MetaLocator and your Identity Provider.

The overall steps involved in this process are:

1. Establish the attribute mappings and user groups in your Identity Provider
2. Establish the mappings within MetaLocator

## Setting up the Identity Provider Attribute Mappings

In this example we are showing a typical Attribute Mapping table. Your SSO provider may vary, but the supported Attributes are listed in the left column below.

[![](https://storage.crisp.chat/users/helpdesk/website/-/f/1/2/3/f123ec7e04869800/b9b4491b-5603-4cbc-a0a0-c3e21e_kfu0lw.png)](https://downloads.intercomcdn.com/i/o/605306287/81c0bb56ae3fe75be7ee2157/image.png?expires=1794512700&signature=16bee09808e604f5e611a36d170de05519ee191182a5bbb94791e2ee61d7999f&req=ciAiFcl4n4lYFb4f3HP0gBzzHUb3RUYPgMXlkjHRinRDd9TLfPlHWREKoafo%0Ad9iDXsbVmBO2y1HlkA%3D%3D%0A)

## Establishing the IdP-side User Groups

The users being created in MetaLocator must be in a group or groups which trigger the mapping, unless the mappings are hard-coded. The example groups are shown for our test user below. There is one group which triggers adding the user to _Group A_ and another which triggers adding the user as a MetaLocator _Group Administrator_.

[![](https://storage.crisp.chat/users/helpdesk/website/-/2/8/8/3/2883951e54c68000/645594d1-f79a-43a4-908c-4814be_f66nb6.png)](https://downloads.intercomcdn.com/i/o/605306955/479c6bb416b2dc68ab4c8c2f/image.png?expires=1794512700&signature=32c7e160835b4a0273b026b9886f590c8923c32a238da28583e3fdb68c8145ab&req=ciAiFcl4lIRaFb4f3HP0gJE%2Bs8bT0veZAefLGhlQ0gNZgVfGZLT8XFV5t3IH%0ArZKIXTXZszM7th5EUQ%3D%3D%0A)

## Setting up the Import Mapping

The Import Mapping stores the lookup between the IdP-side User Groups and the MetaLocator-side User Groups and User Types.

See **Tools** > **Import Mapping** and create mapping entries for both the User Types and User Groups, named 'types' and 'groups' respectively.

[![](https://storage.crisp.chat/users/helpdesk/website/-/8/5/c/3/85c3a93fd6164800/3c980a2d-aab6-4934-b496-b720ea_jzqrmq.png)](https://downloads.intercomcdn.com/i/o/605305752/aac026a592069c1f34a270fa/image.png?expires=1794512700&signature=b21da51bd7558158e805842ed37c0f4e3f5c9ad672c4a2d77ccb60e0e78abf22&req=ciAiFcl7moRdFb4f3HP0gGI5UwFin27aO3Sz2iDHC%2Fbu%2B8bOdDnzyD86lJbw%0A1GXqmSo3ojlUqUVcAw%3D%3D%0A)

**Configuring User Group Mappings**

An example User Group mapping is shown below, where the Field Name is the exact name of the group found in the identity provider which should trigger the placement of the user into the group with User Group ID 3. Ensure the Mapping Type is set to "SSO"

[![](https://storage.crisp.chat/users/helpdesk/website/-/5/7/e/6/57e66c5033eaf800/5b7c032e-ccd9-4b3c-85bc-cf86af_rd4ef0.png)](https://downloads.intercomcdn.com/i/o/605312914/20ff36ffc34477aebc4d194f/image.png?expires=1794512700&signature=0b366917f3e6102e5f1638012c527b3bd4fd7c933add9ae341aee001460b7fec&req=ciAiFch8lIBbFb4f3HP0gKxOsG%2ByqlxIbu8BjLab6s11aVHSmrrcAvLhxD16%0AtOJX56CQSQ%2F5Q1PLCw%3D%3D%0A)

**Configuring User Type Mappings**

An example User Type mapping is shown below, where the Field Name is the exact name of the group found in the identity provider which should trigger the creation of a user with type=43. See the [table below](#h_12b71dea83) for valid user types. Ensure the Mapping Type is set to "SSO"

[![](https://storage.crisp.chat/users/helpdesk/website/-/2/8/b/4/28b466abaeef7e00/a214bff7-072b-4397-b01c-ab2408_o0w643.png)](https://downloads.intercomcdn.com/i/o/605314080/fbed91d34e074794970f11b7/image.png?expires=1794512700&signature=e65c9ea9eb67e665f56ad2030491a300926451be16a4e92e002594b6bb28f791&req=ciAiFch6nYlfFb4f3HP0gHn%2BjgKd2SA4p8hiOgt5NJT5R6BWJilsGxTc%2BKHS%0AtabDVssyWCEsydRh3A%3D%3D%0A)

## Valid User Group IDs for User Types

| User Type | User Group ID |
| --- | --- |
| MetaLocator Administrator | 23 |
| MetaLocator Analytics | 30 |
| MetaLocator API | 14 |
| MetaLocator Country Manager | 37 |
| MetaLocator Group Administrator | 43 |
| MetaLocator Group Data Administrator | 52 |
| MetaLocator Lead Download | 38 |
| MetaLocator Leads | 35 |
| MetaLocator Manager | 41 |
| MetaLocator PaaS API | 15 |
| MetaLocator Crowdsourcing Claim User | 33 |
| MetaLocator Translator | 42 |

## Valid User Group IDs for User Groups

To find valid User Group IDs for your account, first open the User Manager

[![](https://storage.crisp.chat/users/helpdesk/website/-/c/8/2/4/c824824d364ab800/bee11fb4-4640-47b2-bfaa-3c3a17_12eq71h.png)](https://downloads.intercomcdn.com/i/o/605311586/49b13a4bc7d82eb4766399ed/image.png?expires=1794512700&signature=b1526add7d510f975d287b24b12b4791eb68dc40c6472ba9687971dffcbfb80d&req=ciAiFch%2FmIlZFb4f3HP0gLjgGD7pIVhSxRL1BvGGm4xtMBw7wx5QAulRBgwr%0AR9Pr9%2FDHoyS%2FtQDLuA%3D%3D%0A)

Then click User Groups as shown below.

[![](https://storage.crisp.chat/users/helpdesk/website/-/6/0/3/9/603914473b15a000/cef0a09d-d976-41a8-a5fc-7af262_5xj7zy.png)](https://downloads.intercomcdn.com/i/o/605311374/e6fdb778a7f4a0cb9d91f40e/image.png?expires=1794512700&signature=79050c710cc59ed58bb2ac34fa0e2549f11a468277b124f3acde49d8aa83ff31&req=ciAiFch%2FnoZbFb4f3HP0gCw7LwslpukmCzrm2E8c1OALtRTtQapPfNav5VMz%0AQ85RuUxrtPKG0egmGg%3D%3D%0A)

The group IDs are listed here:

[![](https://downloads.intercomcdn.com/i/o/605312008/1ef0db6ed3fdfef912204eea/image.png?expires=1794512700&signature=b870603f387ed36407eb433908d01c718d72654f9a818ad38fbaf51a481d51cd&req=ciAiFch8nYFXFb4f3HP0gOu7To9nTxFoOBzAmi8MPFeBIkGu3n2Tmmh2S0px%0A1wsoZVACTMX0rZHHaA%3D%3D%0A)](https://downloads.intercomcdn.com/i/o/605312008/1ef0db6ed3fdfef912204eea/image.png?expires=1794512700&signature=b870603f387ed36407eb433908d01c718d72654f9a818ad38fbaf51a481d51cd&req=ciAiFch8nYFXFb4f3HP0gOu7To9nTxFoOBzAmi8MPFeBIkGu3n2Tmmh2S0px%0A1wsoZVACTMX0rZHHaA%3D%3D%0A)

## User Group Changes

When user groups change on the IdP-side, MetaLocator can reprocess the updates if `onelogin_saml_updateuser` is set to "1".

In this case, the User Groups will be re-calculated and applied to the user. This includes removals and additions to User Groups only. The User Type is can not be changed via SSO.

## Testing

Visit the SSO Link here:

[https://admin.metalocator.com/index.php?option=com_users&view=login&sso=1&Itemid=129](https://admin.metalocator.com/index.php?option=com_users&view=login&sso=1&Itemid=129)

Enter an email address of a user with appropriate User Groups configured in your SSO Platform.

The user should be created and a message indicating a pending status as shown

[![](https://downloads.intercomcdn.com/i/o/605316496/9acfa9d759c655b940e43464/image.png?expires=1794512700&signature=5aa9568e7f87ccf627d30c83fa2ec169d5e97993ad59e7106a595209eec6a821&req=ciAiFch4mYhZFb4f3HP0gO39oNW65CwroaPpL9MGWhSlbZiDzgRxtXyKR%2Bkq%0AUdEvMTGicQ%2FSyS4saw%3D%3D%0A)](https://downloads.intercomcdn.com/i/o/605316496/9acfa9d759c655b940e43464/image.png?expires=1794512700&signature=5aa9568e7f87ccf627d30c83fa2ec169d5e97993ad59e7106a595209eec6a821&req=ciAiFch4mYhZFb4f3HP0gO39oNW65CwroaPpL9MGWhSlbZiDzgRxtXyKR%2Bkq%0AUdEvMTGicQ%2FSyS4saw%3D%3D%0A)

Administrators will receive a notification that the user has been created via email. If the mapping targets a specific User Group or Groups, administrators for those groups (only) will be notified.

Administrators should review the incoming user, assign any country requirements or make manual adjustments as necessary and then Enable the user.

[![](https://downloads.intercomcdn.com/i/o/605318445/47e16e950f8f8f5b9494174d/image.png?expires=1794512700&signature=23f6772145b507dc3bae2f2bdd863738e4af519034358046d3d0322d91e8e8f9&req=ciAiFch2mYVaFb4f3HP0gN1YmODDIRuPuipgtZeQQHV%2Br5nEMxW037OqL3jG%0A05UCowDpdLh9pl1q%2BA%3D%3D%0A)](https://downloads.intercomcdn.com/i/o/605318445/47e16e950f8f8f5b9494174d/image.png?expires=1794512700&signature=23f6772145b507dc3bae2f2bdd863738e4af519034358046d3d0322d91e8e8f9&req=ciAiFch2mYVaFb4f3HP0gN1YmODDIRuPuipgtZeQQHV%2Br5nEMxW037OqL3jG%0A05UCowDpdLh9pl1q%2BA%3D%3D%0A)

The end user will also receive a notice that their account is pending. Upon enablement by an administrator, the end user will receive a notice that the account was activated and they are free to log in.