Assign User to Group

Overview

Group membership controls application level authorization, in particular access to the SSI Wallet UI.

For detail-oriented flow illustration, please consult Sequence Flow.

Data Space Participant users assigned to super user privileges groups, e.g.authentik Admins are denied to authenticate in Marketplace and SSI Wallet UI. For standard user group creation dedicated for admins, please follow Create Standard User Group and after, proceed with current section steps for user group assignment.

Procedure

1. Authenticate in Authentik Dashboard as akadmin , Administrator account which was created at initial setup.

2. Navigate to Directory → Groups and select the group, open the Users tab.

3. To assign, select Add existing user and choose the user.

The same change can be made from Directory → Users, in the Groups tab of the user.

Verification

• The membership change is visible in the Users tab of the group and in the Groups tab of the user.

• After the user authenticates again, the groups claim of the new token reflects the change.

Notes

• Group membership is not federated. It must be assigned on the Data Space Operator shadow user of a Participant user.

• When authorization must change immediately, revoke the user's sessions and issued tokens from the Sessions and OAuth Refresh Tokens tabs of the user.

Appendix

Sequence Flow