Documentation / Security & Access
Enterprise SSO, IdP group bindings and attribution
Configure enterprise SSO, group-driven RBAC, IdP groups and team, project and cost-center attribution on Custom and Enterprise installations.
1. Enterprise SSO, RBAC and IdP groups
Custom and Enterprise installations configured with OIDC enable enterprise SSO and group-driven RBAC across IdP groups (azure-ad, google-workspace, okta, oidc).
shell
rippflow rbac status --json
rippflow rbac groups bind \
--provider okta \
--group-id "grp-platform-ops" \
--role custom \
--scopes workflow:read,workflow:logs:read,deployment:write \
--team platform --project core-pipeline --cost-center cc-4200 --json
rippflow rbac groups list --limit 50 --json
rippflow rbac groups revoke --provider okta --group-id "grp-platform-ops" --json2. Precedence, cross-tenant protection and attribution
Group bindings require installation >=1.8.0 and users:manage or rbac:manage. Deployments and accounting queries (--team, --project, --cost-center) enforce the caller's bound organizational scopes.
| Control | Enforcement Semantics | Boundary / Status |
|---|---|---|
| Cross-tenant group ownership | Conditional writes prevent any tenant from overwriting or revoking another tenant's (issuer, groupId) binding. | Implemented in Controller (>=1.8.0) |
| Per-subject revocation precedence | A disabled, expired, or revoked subject record fails closed immediately before evaluating group grants. | Implemented in Controller |
| OIDC scope intersection | Non-OIDC token scopes intersect strictly with granted scopes; up to 64 groups are evaluated per token. | Implemented in Controller (>=1.8.0) |
| Team, project & cost-center attribution | Gates --team, --project, --cost-center tags and scoped accounting queries. | Enterprise/Custom only; HTTP 403 on Standard tiers |
Verified sources
Checked 2026-11-05.
- Enterprise SSO and four-layer tier gating 3a3be99 · main
- IdP group bindings and attribution scopes f6c7970 · main
- OIDC scope intersection and subject precedence f6c7970 · main
- RBAC CLI routes and preflight checks 7f5ea32 · main