SSO-Driven Assignment of Scoped Views

SSO-driven group assignment allows Scoped Views to be automatically applied to users based on group membership defined in an external identity provider. When a user accesses Ternary through SSO, the platform evaluates group information passed in the IdP token and applies the corresponding Scoped Views without manual intervention.

SSO group changes are processed when a subsequent sign-in supplies a group set different from the user's stored groups. Changing membership in the identity provider does not immediately update an existing Ternary session.

SSO must be configured and active for the tenant to enable group-based Scoped View assignment. Group names are matched exactly as received from the IdP.

Prerequisites

Before configuring SSO-driven Scoped Views, ensure the following conditions are met:

• An Admin role is available within the Ternary tenant.
• Scoped Views have already been created and validated for the intended access patterns.
• SSO integration with an identity provider is configured and passing group attributes to Ternary.

Important considerations

The following behaviors are important to understand before using SSO-driven group assignment:

• Group names are case-sensitive and must exactly match the group names sent in the IdP token. If a group already exists in Ternary, creating it again will result in an error.
• Deleting a group configuration removes associated Scoped View assignments and can broaden the data shown to affected users. Check the resulting assignments before relying on the intended restrictions.
• For testing changes, creating a duplicate group instead of modifying an existing production group is recommended.
• Membership changes reach this assignment process through a later sign-in with updated group claims. They do not propagate in real time within an existing session.
• When a newly observed matching group is added, its configured status replaces the user's previous assignment on each Scoped View configured for that group. Direct assignments to views outside that group remain unchanged by that addition.
• Manually changing a user's Scoped View status does not create a lasting exemption from SSO group assignment. A later newly observed matching group can replace that status; a later removal of a matching group can remove the user's assignment even after a manual status change. An unchanged group set does not reapply assignments during sign-in.
• Group names cannot be edited after creation. To change a group name, create a copy and configure it separately. This is to prevent an issue of an already working Group being modified and breaking the integration.

How are groups configured in Ternary?

To configure a group:

1. Navigate to Admin → User Group Configurations.
2. Select Add User Group Config.
3. Enter the group name exactly as it appears in the IdP token. Remember, it is case sensitive as well.
4. Associate one or more Scoped Views that should apply to users in this group. Choose a status for each Scoped View. New assignments default to Available, which does not activate or enforce the view; select the intended application mode before saving.
5. Save the configuration.

Once saved, the configuration appears in the User Group Configurations table. Matching group names are reconciled during sign-in when the incoming group set differs from the user's stored groups. If that set is unchanged, signing in again does not by itself reapply a newly created or changed mapping. Check the resulting Scoped View assignments before relying on the intended restrictions.

Use Make Copy to retain the Scoped View selections in a new configuration. The group name is left blank; enter the distinct name of the intended IdP group and review the copied statuses before saving. Copying a configuration does not create an IdP group.

Current limitation (reviewed October 29, 2026): Successful sign-in does not confirm that all Scoped View updates succeeded. Check the resulting assignments before relying on access restrictions. Signing in again with the same group list does not retry failed updates.

If a later SSO sign-in omits the group claim, Ternary treats the group list as empty and processes previous groups as removals. Do not assume previous assignments are preserved; check the IdP group attributes and resulting Scoped View assignments.