Dan HeathandRobin Beck
5ce6515156
* docs: IA reorganization * docs: Updates * docs: Updates * docs: Fix links * docs: Updates * docs: Fix a typo * docs: Fix client agent topic * docs: Update Client Agent nav * docs: Fix conflict * docs: Fix a typo in Client Agent docs (#5853) * docs: Fix client agent topic * docs: Updates * docs: Updates * docs: Updates * docs: Updates * docs: Fixes get started and operations links * docs: Update nav * docs: Partials * docs: Unix partials * docs: Worker partials * docs: Updates * docs: Update workers and targets * docs: Updates * docs: Updates * docs: Fixes link * docs: Updates after sync review * docs: Updates from review feedback * docs: Move worker filter examples * docs: Fix links * docs: Updates for filters based on working session * docs: Fixes broken links * docs: Add links to other filter topics * docs: Update list intro * docs: Adds link * docs: Fixes redirects * docs: Fixes redirects * docs: Deleted mysql page from TOC * docs: Add versioned redirect * docs: Adds versioned redirects * docs: Adds versioned redirects * docs: Update redirects * docs: Update redirects * docs: Redirect fixes * docs: Update redirect format * docs: Fix a typo * docs: Fixes redirects * docs: Fixes redirect * docs: Adds links out to client agent troubleshooting * uses /etc/boundary.d/ as recommended installation directory (#6003) * docs: Updates legacy io links * docs: Fixes redirects * docs: Fix redirect * docs: Restoring deleted file --------- Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
71 lines
2.7 KiB
Plaintext
71 lines
2.7 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Managed group resource
|
|
description: >-
|
|
Learn about using the managed group resource to organize identity provider accounts and assign them grants. Understand how to configure OIDC and LDAP attributes.
|
|
---
|
|
|
|
# Managed groups
|
|
|
|
A managed group is a resource that represents a collection of [accounts][]. The
|
|
collection is formed by evaluating account information defined by the [auth
|
|
method][]'s identity provider against the managed group's configuration; members
|
|
cannot be managed manually. An account can be associated with zero or more
|
|
managed groups within the same [auth method][]. The managed group can be used as
|
|
a principal within [roles][] to assign grants.
|
|
|
|
## Attributes
|
|
|
|
All managed group types have the following configurable attributes:
|
|
|
|
- `name` - (optional)
|
|
If set, the `name` must be unique within the account's auth method.
|
|
|
|
- `description` - (optional)
|
|
|
|
### OIDC managed group information and attributes
|
|
|
|
Membership in OIDC managed groups is evaluated when the auth method is used for
|
|
authentication, based on information contained within the OIDC ID token and the
|
|
OIDC User Info endpoint. Every authentication will result in a new evaluation of
|
|
managed group membership.
|
|
|
|
OIDC managed groups have the following additional attributes:
|
|
|
|
- `filter` - (required)
|
|
A boolean expression defining a filter run against the provided information.
|
|
For general syntax information refer to the [filtering concepts][] page; for more specific information on the data available for this purpose refer to the [managed groups filtering][] page.
|
|
|
|
[filtering concepts]: /boundary/docs/filtering
|
|
[managed groups filtering]: /boundary/docs/rbac/users/managed-groups
|
|
|
|
### LDAP managed group information and attributes
|
|
|
|
Membership in LDAP managed groups is evaluated when the auth method is used for
|
|
authentication, based on information contained within the LDAP server. Every
|
|
authentication results in a new evaluation of managed group membership.
|
|
LDAP managed groups have the following additional attributes:
|
|
|
|
- `group-names` - (required)
|
|
A list of group names.
|
|
|
|
## Referenced by
|
|
|
|
- [Accounts][]
|
|
- [Auth method][]
|
|
|
|
[accounts]: /boundary/docs/domain-model/accounts
|
|
[auth method]: /boundary/docs/domain-model/auth-methods
|
|
[roles]: /boundary/docs/domain-model/roles
|
|
|
|
## Service API docs
|
|
|
|
The following services are relevant to this resource:
|
|
|
|
- [Managed group service](/boundary/api-docs/managed-group-service)
|
|
|
|
## Tutorial
|
|
|
|
Refer to the [Manage users and groups with HCP Boundary](/boundary/tutorials/hcp-administration/hcp-manage-users-groups) tutorial to learn how to complete user management related tasks.
|
|
|
|
Refer to the [Identity management](/boundary/tutorials/identity-management) tutorials to learn about OIDC, LDAP, and managed groups. |