How to control SSO PingID oneaccount using AD groups

[NidhiSingh]

We have integrated Saviynt with PingID OneAccount for SSO implementation, using two approaches- one for Admin another for non-admin users. List of Admin users are put into AD groups for authentication.  We are assigning ROLE_ADMIN SAV Role for Admin users, if new user comes in and they are assigned ROLE_ADMIN SAV Role in Saviynt, how to control SSO for the Admin user AD groups. 

[rushikeshvartak]

You can use ROLE_USER sav role for end users.

[NidhiSingh]

End users are not being assigned to AD group, the Admin users on the other hand are assigned with a AD group "ADMINS". Whenever SSO authentication happens, the user having ROLE_ADMIN SAV Role should be validated against Admins AD group. If any user is not part of this AD group but having ROLE_ADMIN SAV Role in Saviynt, then SSO should not work. Is there any correlation attribute can be used to store the AD group in Saviynt.

[rushikeshvartak]

• SSO will not check correlation in saviynt. it will validate if user is part of particular SSO authorization group or not.

[NidhiSingh]

If user is not part of SSO auth group then it will be considered as non admin and user can access Saviynt with ROLE_ADMIN role without any issues.. This is deviating from the design of Admin users.
Is there any way we can restrict the users accessing Saviynt with ROLE_ADMIN + SSO Group member in AD?

[rushikeshvartak]

• You can't have paramutations