When Okta or Entra ID (SCIM) is used as an external identity provider, the option is available to use groups in the identity provider to control users access levels in Xakia.
This gives administrators of the identity provider full control over how matter access is assigned to users in Xakia.
When Identity Provider Groups are used to control matter access, the users access level cannot be changed manually. The users access level can only be controlled via the external identity provider group membership.
How It Works
In the external identity provider, assign one or more groups to the SCIM app. The groups will be synced to Xakia.
In Xakia, in the Federated Identity page in Admin, the synced groups and all their members are shown at the bottom of the page under "Identity Provider Groups".
The membership of each group is read-only within Xakia - this displays only the Xakia users that are a member of the group in the identity provider. To change this membership, you must change it in the identity provider.
Assign a Xakia matter access level to the group (e.g. *All Matters*).
All members of the group receive that access level.
Any new users created via SCIM who belong to the group will receive the assigned access level instead of the usual default (*My Matters*).
If a user belongs to more than one group, they receive the highest access level across all their groups. For example, if a user belongs to Group A and Group B, and Group A grants the user My Matters access, and Group B grants the user All Matters access, the user ends up with All Matters access.
IMPORTANT NOTES:
Purely for access control: These groups are used solely to manage matter access via SCIM. They cannot be assigned to matters.
Not the same as Xakia groups: Groups synced from the external identity provider do not equate to Xakia groups, or membership within Xakia groups, even if the names match. Xakia groups and external identity provider groups are entirely separate mechanisms.