> For the complete documentation index, see [llms.txt](https://knowledgebase.autorabit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.autorabit.com/product-guides/codescan/codescan-integration/single-sign-on-sso/idp-group-mapping-wip.md).

# IdP Group Mapping for Dedicated Instances

{% hint style="info" %}
NOTE: This feature is only available to customers who have a dedicated instance. It is not available for customers who are deployed on our SaaS multi-tenant instances.
{% endhint %}

The Org admin can configure mapping between IdP Groups and Codescan Organization Groups on the SAML Configuration screen.

This feature allows to implement **many-to-many** mapping between IdP Groups and Codescan Orgs. 

When IdP Connection is configured to send the user groups, then **SAML Response** which we receive during User login contains the list of IdP Groups. Based on this data we can do the synchonization every time the user logs in. 

> **Before configuring the IDP Group Mapping, a SAML connection must be configured.**  [**Find out how in these articles.**](/product-guides/codescan/codescan-integration/single-sign-on-sso.md)

To configure the mapping between IdP Groups and Codescan Orgs and Groups:

1. [Navigate to **Administration > Configuration > General Settings > Organizations:**](#user-content-fn-1)[^1]
   1. Disable `Allow any autheticated user to create organizations`
   2. Disable `Create an organization for each new user`<br>
2. [Navigate to **Administration > Configuration > General Settings > CodeScan**](#user-content-fn-1)[^1]**:**
   1. Enable `CodeScan idp-group-mapping`&#x20;
3. Navigate to **Administration > SAML Connections** and edit the connection of your choice.  There is a **IdP Group Mapping** section on the SAML Configuration screen:

<figure><img src="/files/Uz4coHgiiacJfGkyk2BY" alt=""><figcaption></figcaption></figure>

You can add multiple rows for the mapping. In each row you define:

1. the IdP Group name - this is the text field;
2. the Codescan Org - this is the selection input
3. the Codescan Org Groups - this is set of checkboxes with the list of all Groups of the selected Org. The default Org Group is selected by default (e.g. Members group).

This configuration can be done only by the Org admin. And the Org Admin can modify this mapping anytime.

The Codescan will go through this list and programmatically add/remove users to Codescan Orgs based on that mapping.

[^1]: This section must be performed by a Platfrom Super Admin User on your dedicated instance


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://knowledgebase.autorabit.com/product-guides/codescan/codescan-integration/single-sign-on-sso/idp-group-mapping-wip.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.