Assigning roles to SAML users and groups
Once SAML/SSO has been configured, users will be provisioned at login. By default, users will be assigned the Remote Edit User
role. If the SAML IDP is sending group information to Lens, then the Lens Portal can automatically assign a role to a user based on their SAML groups.
How roles are evaluated
A users role is evaluated based on the following criteria:
If a users role has a role other than
Deny access
, they use the users assigned roleIf a users role is
Deny access
but they are part of a group that does allow access, then they will be assigned the group’s roleIf a user's role is
Deny access
and they are not part of a group, then they will be denied access
Assigning a role based on SAML groups
Login to the Lens Portal. The user must have the 'Access to Settings' permission for the location where the scheduler will be enabled.
In the left sidebar, open the
Configuration
menu, then select theSettings
optionUnder the
Roles
group, select theIdentity Mapping
optionClick the
Add
buttonA
Add role mapping
modal will appear. In theGroup Name
field enter the name of the SAML group. This is case-sensitive.In the
Role
field, select the role you would like users that have the specified group name to have.Click the
Add
button
Assigning a role to a SAML user
Login to the Lens Portal. The user must have the 'Access to Settings' permission for the location where the scheduler will be enabled.
In the left sidebar, open the
Configuration
menu, then select theSettings
optionUnder the
Roles
group, select theIdentity Mapping
optionCheck the checkbox next to the user you want to assign a role to
Click the
Edit
buttonIn the
Role
field, select the new roleClick the
Edit
button
![](../../../__attachments/2817884252/image-20230206-150624.png?inst-v=e065097c-ce54-4077-bfce-12cc2b09b30d)