Skip to main content
SSO Role Mapping lets you automatically assign Strada roles to members based on their group or role membership in your identity provider (IdP). When a member logs in via SSO, Strada reads the SAML assertion and grants the corresponding role. Navigate to Settings > Organization > Provisioning > SSO to configure.

​
Prerequisites

Before configuring role mappings, you need:
  • An active SAML SSO connection (configured by the Strada team)
  • A SAML attribute in your IdP that sends group or role information

​
Configuring Your IdP

To use role mapping, your IdP must include a group or role attribute in the SAML assertion. This attribute tells Strada which groups the authenticating user belongs to.

​
Attribute Mapping

Add a Group Attribute Statement in your IdP’s SAML application configuration. The attribute name must be set to stradaRole.
The exact steps to add a group attribute vary by identity provider. See the provider-specific examples below.

​
Okta

  1. Open your Strada SAML app in the Okta Admin Console
  2. Go to General > SAML Settings > Edit
  3. In the Group Attribute Statements section, add:
This sends all of the user’s Okta groups in the SAML assertion. You can use a more specific filter (e.g., Starts with Strada) to limit which groups are sent.

​
OneLogin

  1. Open your Strada SAML app in the OneLogin Admin Portal
  2. Go to Parameters
  3. Click Add Parameter (or the + icon)
  4. Set the Field name to stradaRole
  5. Check Include in SAML assertion
  6. Set the Value to the user’s role or group field (e.g., User Roles or a custom field)
  7. Save

​
Microsoft Entra ID

  1. Open your Strada Enterprise Application in the Azure Portal
  2. Go to Single sign-on > Attributes & Claims
  3. Click Add a group claim
  4. Select which groups to include (e.g., Groups assigned to the application)
  5. Under Advanced options, check Customize the name of the group claim
  6. Set the Name to stradaRole
  7. Save

​
Other Providers

For any SAML 2.0 compatible IdP, add an attribute statement that:
  1. Has the name stradaRole
  2. Returns the user’s group or role name as a string value
  3. Is included in the SAML response sent to Strada

​
Mapping Groups to Roles

Once your IdP is sending the stradaRole attribute:
  1. Navigate to Settings > Organization > Provisioning
  2. Select the SSO tab
  3. Under SAML Group-to-Role Mapping, click Add Mapping
  4. Enter the IdP group/role name exactly as it appears in your IdP (case-sensitive)
  5. Select the Strada role to assign
  6. Click Save Mappings
See Roles & Permissions for the full list of available roles.

​
Visibility

Provisioning settings are visible to Admin, IT Admin, and Executive roles. Configuring role mappings requires Admin or IT Admin.