How KaseyaOne assigns roles using IdP mapping rules has changed

NAVIGATION  Header > Admin Settings > Single Sign-On

PERMISSIONS  Admin role

To support customized roles in KaseyaOne, the way IdP Groups Access Control assigns KaseyaOne roles to users has changed for the Process all rules processing logic mode.

What changed

Previously, when a user matched more than one mapping rule under Process all rules, KaseyaOne assigned the highest-ranked system role across all matching rules, regardless of rule order.

With this change:

  • The Process all rules mode is now called Assign all Groups.

  • When a user matches more than one mapping rule under Assign all Groups, KaseyaOne assigns the role from the topmost matching rule. Rule order determines which role the user receives. KaseyaOne groups are unaffected. All matching rules still contribute their groups, and the user receives all groups from every matching rule.

  • Drag-and-drop reordering is supported for Assign all Groups rules.

NOTE  This change does not affect the Stop at first match processing logic mode. That mode is unchanged.

What happened automatically

If you had been using Process all rules, KaseyaOne automatically assigned a priority order, based on your existing Process all rules mapping rules, to create your Assign all Groups mapping rules. Rules were ordered based on the system-role rank of the KaseyaOne role assigned in each rule, from highest rank to lowest, with ties broken by the existing row order.

For most organizations, this automatic ordering reproduces the same role outcomes users received before the change. However, you should review the updated order, especially if you want a role other than your highest-ranked role to take priority for users who match more than one rule.

How to...

To review your mapping rules and reorder them if needed, complete the following steps:

  1. Navigate to the Single Sign-On page.
  2. In the Mapping Rules section, review the current rule order. The topmost rule that matches a user determines the role that user receives. Rules below the first match still contribute their KaseyaOne groups.
  3. If the current order does not reflect the role priority you want, drag and drop rules into the correct order.
  4. Once you're satisfied with the rule order, click Acknowledge in the banner at the top of the page to confirm you have reviewed the changes. Acknowledging the banner removes it for all administrators in your organization.

Your updated rule order takes effect immediately. For the full procedure for configuring IdP Groups Access Control, refer to Configure third-party IdP Groups Access Control in KaseyaOne.

FAQ

Possibly, if users currently match more than one mapping rule under Assign all Groups.

The automatic rule ordering is designed to reproduce your previous role outcomes in most cases. However, if a user matches multiple rules and the topmost matching rule assigns a different role than they previously received, their role changes at their next authentication. Review your rule order and reorder as needed.

Yes, but only after you have reviewed and confirmed your rule order.

The banner remains visible to all administrators in your organization until any one administrator clicks Acknowledge. Acknowledging the banner is account-wide, it removes the banner for all administrators permanently. Review your mapping rule order before acknowledging so that you can be confident the order is correct.

Nothing has changed for you. Stop at first match behavior is unchanged.

The banner and automatic rule reordering only apply to organizations using Assign all Groups. If your organization uses Stop at first match, no action is required and you will not see the banner.

No. KaseyaOne group assignments are unaffected by this change.

Under Assign all Groups, KaseyaOne groups continue to be assigned from every matching rule. The user receives the union of groups from all rules that match. This behavior has not changed. Only role assignment is affected.