Group memberships

Automation orchestrator includes group memberships in JWT access token claims. Groups determine authorization through role assignments.

After a user logs in, they are implicitly added to the authenticated group. Additional group memberships come from identity provider claims (for OIDC users) or the user management API (for local users). You can add any user to any group, including identity provider users.

For identity provider users, login requires either Allow all authenticated enabled on the provider or explicit group mappings that match the user's identity provider groups. Users who do not meet either requirement cannot log in and do not receive authenticated group membership.

Group memberships are session-scoped. When a user logs in through an identity provider, automation orchestrator derives group memberships from that session's identity provider claims. Groups from different identity providers are not combined across sessions.

Groups have a source field that indicates whether they were created locally or by an identity provider. Automation orchestrator seeds the following built-in groups on startup: authenticated (implicit for all logged-in users), users, admins, and auditors. Built-in groups cannot be deleted.