User groups¶

User accounts are organised in logical groups, which simplify the assignment of access rights to applications through access contracts. Groups are always managed in the context of an authentication domain: a group belongs to exactly one domain.

The behaviour of this module depends on the type of the selected domain:

Domain type	Group management
Local directory	Manual add and delete.
SAML (federation domains)	Manual add and delete. Groups are identified by an external id that matches the group identifier on the identity provider. Bulk CSV import is available.
LDAP (standard mode, synchronised groups)	Read-only — groups are retrieved automatically from the directory. Add and delete buttons are disabled.
LDAP with manual group management	Manual add and delete. The Description field is hidden (the description comes from the directory).
Anonymous directory	Not applicable — anonymous domains do not appear in the domain selector.

Element	Description
Domain (drop-down)	Filters the displayed groups by domain. Only non-anonymous domains are listed. The selection controls which buttons are enabled and the visibility of the External id column.
Search field	Filters the groups list by name substring. The search is triggered 700 ms after the last keystroke, or immediately with the `Enter` key. A `×` trigger clears the field.
Pagination	15, 25 or 50 entries per page (default: 15).
Grid columns	Name (with icon), External id (hidden except for federation domains) and Description. With no group, the grid shows No available groups; with no domain, the drop-down shows No available domains.

Add a user group¶

Select the target domain in the drop-down list at the top right.
Click on the + button.
Fill in the fields and confirm.

Form fields¶

Field	Description
Name	Group name. Mandatory. Cannot consist of whitespace only. The `;` character is not allowed. Uniqueness is checked within the domain, regardless of case: a duplicate is rejected with The group already exists.
External id	Displayed only for federation domains (SAML). Holds the identifier of the group on the identity provider; it is used to map an authenticated user to the correct Bastion group. If left empty, the value of the Name field is used as a fallback.
Description	Free-text description of the group. The `;` character is not allowed. Hidden for LDAP domains in manual-management mode.

CSV import — federation domains only

For SAML domains, an Import button allows groups to be added in bulk from a CSV file. The expected columns are:

External id
Name
Description

Edit a user group¶

⛔ An existing group cannot be edited, whatever the domain type. The toolbar carries three actions only — Add, Delete and Import — with no Properties icon, and double-clicking a row of the grid does nothing.

Changing the name, external id or description of a group therefore means deleting it and creating it again, bearing in mind the access contracts that reference it (see section Delete a user group).

Delete a user group¶

Select one or more groups in the list (multi-selection is supported).
Click on the × button.
Confirm: the console asks Are you sure you want to delete this group?, plural when several groups are retained.

Specific cases¶

Groups bound to « everyone » access contracts

If one or more selected groups are bound to an access contract that targets every group in the domain (« everyone » clause), an intermediate Group deletion window is displayed before the actual deletion.

Non-deletable groups (blocked by a strict dependency) are listed at the top in orange.
For each potentially deletable group, choose in the Action column:
- Delete to confirm the deletion,
- Do not delete to keep the group (default value).
Confirm to apply the choices.

Deletion report¶

If the deletion fails for some groups (server-side constraints not caught client-side), a report window lists the affected groups with the associated error message.