## Manage SSO group mapping

URL: https://docs.atlan.com/product/capabilities/build-apps/sdks/python/users-groups/how-tos/manage-sso-group-mapping

> Manage SSO group mapping in Atlan programmatically using the Python SDK (pyatlan). Use AtlanSSO to map identity provider groups to Atlan groups via the SDK.

# AtlanSSO: manage SSO group mapping

Use `AtlanSSO` in the Atlan Python SDK to programmatically manage SSO group mappings between your identity provider and Atlan groups.

You can use the SDK's SSO client to manage your SSO group mapping in Atlan.

## Create new group mapping

To create a new SSO group mapping:

### Java

:::warning[Coming soon]
:::

### Python

```python showLineNumbers title="Create a new SSO group mapping"

from pyatlan.client.atlan import AtlanClient
from pyatlan.model.enums import AtlanSSO

client = AtlanClient()

atlan_group = client.group.get_by_name("atlan-group") # (1)
atlan_group = atlan_group.records[0]

response = client.sso.create_group_mapping( # (2)
 sso_alias=AtlanSSO.AZURE_AD,
 atlan_group=atlan_group,
 sso_group_name="sso_group_name",
)
```

1. Begin by retrieving the Atlan group for which you wish to create a group mapping.
In this example, we retrieve an existing Atlan group by its name.
2. To create a new group mapping, provide the following:

 - name of the SSO provider.
 - existing Atlan group.
 - name of the existing SSO group.

### Kotlin

:::warning[Coming soon]
:::

### Raw REST API

```json showLineNumbers title="POST /api/service/idp/azure/mappers"
{
 "identityProviderAlias": "azure", // (1)
 "identityProviderMapper": "saml-group-idp-mapper",
 "name": "0d9b0028-513c-4536-af90-d594ef2d549c--1713772147406", // (2)
 "config": {
 "syncMode": "FORCE",
 "attributes": "[]",
 "are.attribute.values.regex": "",
 "attribute.name": "memberOf",
 "group": "atlan_group_name", // (3)
 "attribute.value": "sso_group_name" // (4)
 }
}
```

1. Specify the SSO provider; here, we create group mapping for `Azure AD` SSO.
2. Set the group mapping name in the format `<atlan_group_id>--<epoch_timestamp>`.
3. Provide the name of the existing Atlan group.
4. Provide the name of the existing SSO group.

## Retrieve group mapping

### Retrieve group mapping by ID

To retrieve an existing SSO group mapping:

### Java

:::warning[Coming soon]
:::

### Python

```python showLineNumbers title="Retrieve an existing SSO group mapping"

from pyatlan.client.atlan import AtlanClient
from pyatlan.model.enums import AtlanSSO

client = AtlanClient()

response = client.sso.get_group_mapping( # (1)
 sso_alias=AtlanSSO.AZURE_AD,
 group_map_id="0637576a-5419-40d7-b6cb-fe5841b1da4b",
)
```

1. To retrieve an existing group mapping, provide the following:

 - name of the SSO provider.
 - existing SSO group map identifier.

### Kotlin

:::warning[Coming soon]
:::

### Raw REST API

```json showLineNumbers title="GET /api/service/idp/azure/mappers/0637576a-5419-40d7-b6cb-fe5841b1da4b"
```

:::tip[All details are present the URL itself]
Note that you need to specify the SSO alias and map identifier
directly in the URL. For this example, we're retrieving a group mapping for `Azure AD` SSO.
:::

### Retrieve all group mappings

To retrieve all existing SSO group mappings:

### Java

:::warning[Coming soon]
:::

### Python

```python showLineNumbers title="Retrieve all existing SSO group mappings"

from pyatlan.client.atlan import AtlanClient
from pyatlan.model.enums import AtlanSSO

client = AtlanClient()

response = client.sso.get_all_group_mappings(sso_alias=AtlanSSO.AZURE_AD) # (1)
```

1. To retrieve all existing group mappings,
you need to provide the name of the SSO provider.
Here, we're retrieving all group mappings for `Azure AD` SSO.

### Kotlin

:::warning[Coming soon]
:::

### Raw REST API

```json showLineNumbers title="GET /api/service/idp/azure/mappers"
```

:::tip[All details are present the URL itself]
Note that you need to specify the SSO alias directly in the URL.
For this example, we're retrieving all group mappings for `Azure AD` SSO.
:::

## Update existing group mapping

To update an existing SSO group mapping:

### Java

:::warning[Coming soon]
:::

### Python

```python showLineNumbers title="Update an existing SSO group mapping"

from pyatlan.client.atlan import AtlanClient
from pyatlan.model.enums import AtlanSSO

client = AtlanClient()

atlan_group = client.group.get_by_name("atlan-group") # (1)
atlan_group = atlan_group.records[0]

response = client.sso.update_group_mapping( # (2)
 sso_alias=AtlanSSO.AZURE_AD,
 atlan_group=atlan_group,
 group_map_id="0637576a-5419-40d7-b6cb-fe5841b1da4b",
 sso_group_name="sso_group_name_updated",
)
```

1. Begin by retrieving the Atlan group for which you wish to update a group mapping.
In this example, we retrieve an existing Atlan group by its name.
2. To update an existing group mapping, provide the following:

 - name of the SSO provider.
 - existing Atlan group.
 - existing SSO group map identifier.
 - updated name of the existing SSO group.

### Kotlin

:::warning[Coming soon]
:::

### Raw REST API

```json showLineNumbers title="POST /api/service/idp/azure/mappers/0637576a-5419-40d7-b6cb-fe5841b1da4b"
{
 "identityProviderAlias": "azure", // (1)
 "identityProviderMapper": "saml-group-idp-mapper",
 "id": "0637576a-5419-40d7-b6cb-fe5841b1da4b", // (2)
 "name": "0d9b0028-513c-4536-af90-d594ef2d549c--1713772147406", // (3)
 "config": {
 "syncMode": "FORCE",
 "attributes": "[]",
 "are.attribute.values.regex": "",
 "attribute.name": "memberOf",
 "group": "atlan_group_name", // (4)
 "attribute.value": "sso_group_name_updated" // (5)
 }
}
```

1. Specify the SSO provider; here, we update group mapping for `Azure AD` SSO.
2. Specify the existing SSO group map identifier.
3. Specify the name of the existing SSO group map.
4. Provide the name of the existing Atlan group.
5. Provide the updated name of the existing SSO group.

### Delete group mapping

To delete an existing SSO group mapping:

### Java

:::warning[Coming soon]
:::

### Python

```python showLineNumbers title="Delete an existing SSO group mapping"

from pyatlan.client.atlan import AtlanClient
from pyatlan.model.enums import AtlanSSO

client = AtlanClient()

response = client.sso.delete_group_mapping( # (1)
 sso_alias=AtlanSSO.AZURE_AD,
 group_map_id="0637576a-5419-40d7-b6cb-fe5841b1da4b"
)
```

1. To delete an existing group mapping,
you need to provide the SSO alias and map identifier.
Here, we're deleting the group mapping for `Azure AD` SSO.

### Kotlin

:::warning[Coming soon]
:::

### Raw REST API

```json showLineNumbers title="POST /api/service/idp/azure/mappers/0637576a-5419-40d7-b6cb-fe5841b1da4b/delete"
```

:::tip[All details are present the URL itself]
Note that you need to specify the SSO alias and map identifier
directly in the URL. For this example, we're deleting a group mapping for `Azure AD` SSO.
:::

---