> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getstrada.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Role Mapping

> Map SAML groups from your identity provider to Strada roles

SSO Role Mapping lets you automatically assign Strada roles to members based on their group or role membership in your identity provider (IdP). When a member logs in via SSO, Strada reads the SAML assertion and grants the corresponding role.

Navigate to **Settings > Organization > Provisioning > SSO** to configure.

***

## Prerequisites

Before configuring role mappings, you need:

* An active SAML SSO connection (configured by the Strada team)
* A SAML attribute in your IdP that sends group or role information

***

## Configuring Your IdP

To use role mapping, your IdP must include a **group** or **role** attribute in the SAML assertion. This attribute tells Strada which groups the authenticating user belongs to.

### Attribute Mapping

Add a **Group Attribute Statement** in your IdP's SAML application configuration. The attribute name must be set to `stradaRole`.

| Setting            | Value                                |
| ------------------ | ------------------------------------ |
| **Attribute Name** | `stradaRole`                         |
| **Value**          | The user's group or role in your IdP |

<Note>
  The exact steps to add a group attribute vary by identity provider. See the provider-specific examples
  below.
</Note>

### Okta

1. Open your Strada SAML app in the Okta Admin Console
2. Go to **General** > **SAML Settings** > **Edit**
3. In the **Group Attribute Statements** section, add:

| Name       | Name Format | Filter        | Value |
| ---------- | ----------- | ------------- | ----- |
| stradaRole | Basic       | Matches regex | `.*`  |

This sends all of the user's Okta groups in the SAML assertion. You can use a more specific filter (e.g., `Starts with Strada`) to limit which groups are sent.

### OneLogin

1. Open your Strada SAML app in the OneLogin Admin Portal
2. Go to **Parameters**
3. Click **Add Parameter** (or the **+** icon)
4. Set the **Field name** to `stradaRole`
5. Check **Include in SAML assertion**
6. Set the **Value** to the user's role or group field (e.g., `User Roles` or a custom field)
7. Save

### Microsoft Entra ID

1. Open your Strada Enterprise Application in the Azure Portal
2. Go to **Single sign-on** > **Attributes & Claims**
3. Click **Add a group claim**
4. Select which groups to include (e.g., **Groups assigned to the application**)
5. Under **Advanced options**, check **Customize the name of the group claim**
6. Set the **Name** to `stradaRole`
7. Save

### Other Providers

For any SAML 2.0 compatible IdP, add an attribute statement that:

1. Has the name `stradaRole`
2. Returns the user's group or role name as a string value
3. Is included in the SAML response sent to Strada

***

## Mapping Groups to Roles

Once your IdP is sending the `stradaRole` attribute:

1. Navigate to **Settings > Organization > Provisioning**
2. Select the **SSO** tab
3. Under **SAML Group-to-Role Mapping**, click **Add Mapping**
4. Enter the **IdP group/role name** exactly as it appears in your IdP (case-sensitive)
5. Select the **Strada role** to assign
6. Click **Save Mappings**

See [Roles & Permissions](/settings/organizations/roles-and-permissions) for the full list of available roles.

***

## Visibility

Provisioning settings are visible to Admin, IT Admin, and Executive roles. Configuring role mappings requires Admin or IT Admin.