Add Developer Teams from Identity Providers

In the Konnect Dev Portal, you can map existing developer teams from a third-party identity provider (IdP) and their permissions to elements in Konnect. With teams mapped from an IdP, the developers and permissions are mapped automatically in Konnect so you don’t have to manually copy over each team of developers.

This guide explains how to map the permissions, including scopes and claims, from your group of developers in your IdP to your organization’s team in Konnect. Although this guide uses Okta, Azure Active Directory (AD), and Auth0 as examples, you can use any IdP that conforms to OIDC standards.

Prerequisites

A test developer account in your IdP
An application for Konnect configured in your IdP:
- Okta
- Azure AD
- Auth0

Set up developer teams and group claims in your IdP

Okta

Azure AD

Auth0

In Okta, assign people to a group, including your test developer account. Alternatively, you can use group rules to automatically add people to a group.
Configure any other group settings and attributes as needed.
Enable group push for Kong Gateway to push existing Okta groups and their memberships to Konnect.
Add a groups claim for the org authorization server.

In Azure AD, create a new group that includes your test developer account.
Configure a groups claim.

In Auth0, create a new team of developers that you want to map to Konnect. Make sure to add your test developer account.
Configure a groups claim.

Map IdP developer teams in Konnect

In Dev Portal, click Settings.
In the General setting tab, enable Portal RBAC.

Enabling RBAC allows you to create teams in Konnect. You can disable RBAC after you map teams from your IdP if you don’t want to use it.
From the Teams settings in the side bar, click New Team and configure the team.
From the IdP team you just created, click the Products tab and click Add Roles. This allows you to assign API products and the role for the API product to members of your IdP team.
From Settings in the Dev Portal side bar, click the Identity tab and then click Configure OIDC provider.
Configure the IdP settings using the following mappings:
- Provider URL: The value stored in the issuer variable from your application in your IdP.
- Client ID: The application ID from your application in your IdP.
- Client Secret: The client secret from your application in your IdP.
- Scopes: The scopes to be requested from your application in your IdP.
- Claim Mappings - Name: name
- Claim Mappings - Email: email
- Claim Mappings - Groups: groups
Click the Team Mappings tab, and then select IdP Mapping Enabled.
Enter the exact name of your team from your IdP next to the name of the Konnect team you want to map it to.

Test developer team mappings

Now that you’ve configured the IdP team mappings in Konnect for the Dev Portal, you can test the team mappings by logging in to the Dev Portal with a test account that is assigned to the team in your IdP.

Navigate to your Dev Portal URL and log in as a test developer that is assigned to the team in your IdP. You can find your Dev Portal URL in the Dev Portal settings in the Portal Domain tab.
If the mappings are correct, you should see any API products that you assigned to the team in Konnect.

Once a developer in your IdP team signs into the Dev Portal, they will be populated as a new developer associated with that team in Konnect. You can verify this by going to the Dev Portal teams settings in Konnect. The test developer should be listed there as a developer associated with your team.