Grant workspace access with IdP groups

Give users from your identity provider (IdP) a platform role and a role on a workspace, using their group claim.

Prerequisites

Dashboard oauth or proxy mode, configured as in Configure OAuth sign-in or Configure proxy authentication.
A group claim in your users’ tokens or proxy headers.

Steps

Find the value your IdP puts in the group claim. Group matching is exact and case-sensitive, so list that value.

IdP	Claim	Value to list
AWS Cognito	`cognito:groups`	The group name, such as `omnia-admins`
Entra ID	`groups`	The group object ID (GUID) by default, such as `c16e8ed8-544e-489c-bbb6-9b027822ddc7`
Okta and other OIDC	`groups`, or the claim in `dashboard.oauth.claims.groups`	Whatever the claim carries, usually the name
Google	none	Nothing: Google issues no groups claim. Grant access by email with `directGrants`

Map groups to the platform role in your Helm values. Platform roles (admin, editor, viewer) cover dashboard-wide actions such as settings, users and other users’ API keys. They grant nothing inside a workspace.
```
dashboard:
  auth:
    roleMapping:
      adminGroups: [omnia-admins]
      editorGroups: [omnia-editors]
```

Bind the groups to a role on each workspace. The workspace role (owner, editor or viewer) decides what a user can do with that workspace’s agents, sessions and data.

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Workspace
metadata:
  name: customer-support
spec:
  displayName: "Customer Support"
  namespace:
    name: omnia-customer-support
    create: true
  roleBindings:
    - groups: ["omnia-admins"]   # the Cognito group name; use the GUID for Entra ID
      role: owner

kubectl apply -f workspace.yaml

For editor and viewer bindings, directGrants and ServiceAccount bindings, see Manage workspaces. The Workspace reference lists the fields.

Verify

Sign in as a user in the mapped group and open the workspace in the dashboard. Its agents, sessions and data are visible.

Troubleshooting

A platform admin sees an empty workspace

A platform role never grants data access in a workspace. Add a roleBinding or directGrant for the user, or open Settings → Access in the workspace and add one there. A platform admin can manage access on any workspace.

The user has the wrong role

Decode the user’s token and confirm the group claim carries the value you listed.
Compare the value to the binding character by character, including case.
For Entra ID, list the object ID. To emit names instead, change the groups claim in the app registration’s token configuration.