Group management

On the Group Management screen, you create user groups and register and synchronize groups from external identity providers (IdPs). A group is an administrative unit that grants permissions to multiple users at once.

Administrator-only page

Only admin type users can enter. If an unauthorized user accesses this screen, they are automatically returned to home.

Approach

In the sidebar, go to the System → Settings → Group menu.

Group list

The created groups are displayed as a table.

column	Description
Name	Group name. SSO groups are marked "Synced from identity provider."
Provided by	Local Group or Federated Identity Provider Name (SSO)
Created date	Date the group was created

Select/delete multiple groups

You can select multiple groups at once using the checkboxes to the left of the list. The header checkbox menu allows you to select all filter results in addition to the current screen (e.g. "Select all five groups of filter results").

When you select more than one, a Batch Actions Bar will appear above the list. On the left is a selection number (e.g. "3 groups selected") and Deselect, and on the right is Delete. When you press Delete, a confirmation window will appear, and once confirmed, the selected group will be deleted all at once.

• Groups with affiliated users are excluded from batch deletion. To delete, you must first remove all members.
• If you change the search term or filter, the selection will be cleared. The selection is maintained when you just turn the page.

Create group

Clicking the Create Group button at the top right of the list opens the creation dialog.

field	Required	Description
Provided by		Local or federated identity provider name (e.g. Keycloak). Appears only in environments where a writable ID provider is integrated.
Name	✅	Distinguished name of the group

• Local (default): Creates a group in D.Hub. A notice will appear stating that local groups can only be assigned to local users.
• Writable identity provider (e.g. Keycloak): Pick an identity provider from Provider and the group will be created directly in that identity provider (you will see a "This group will be created in Keycloak" prompt).

Enter a name and click Create to create the group. The Provider selection appears only when an identity provider that supports writing is integrated, and only local groups can be created in an environment where only a lookup-only identity provider (e.g. Azure AD) is integrated.

tip

It is recommended that group names be created systematically according to the organization/project unit. Example: data-engineering-team, project-alpha-viewers

Member assignment

In the group list, clicking Manage Members in the group row opens the Group Members window. Here, you can directly search for users belonging to that group, select users, add them, or remove them by row. A user can also belong to multiple groups at the same time.

• Local Group: Members can be added or removed at any time.
• SSO(OIDC) Group: Members can only be changed if the federated identity provider supports editing (e.g. Keycloak). Groups in lookup-only identity providers (such as Azure AD) can only view their members, and member configuration is managed by that identity provider.

When editing a user on the user management screen, the only groups that can be assigned are local groups. The member configuration of the SSO (OIDC) group can only be changed in the member management window above.

SSO(OIDC) Group

Once SSO is configured, you can register and synchronize groups from external identity providers.

• ID Provider Group Registration Button (the associated identity provider name appears on the button — e.g. “Register Keycloak Group”): When pressed, the registration window will open. Select a group that has not yet been registered from the ID provider's group list (name, external ID, registration status) and register it at once.
• Individual Sync: Clicking Sync in the action menu of an SSO group row will update the group information based on the identity provider. If a group has already been deleted from your identity provider, you will be notified of that fact.

info

Group registration/synchronization occurs only in one direction: ID provider → D.Hub. Changing groups in D.Hub will not be reflected in the identity provider.

Delete group

Select Delete from the row's action menu. However, if there are users belonging to them, they cannot be deleted, so you must first remove all users from the group.

Delete an identity-provider group

Deleting a group synchronized from an identity provider removes only the D.Hub group. It does not delete the group from the identity provider, and a later synchronization can register it again.

Managing permissions by group

Management is easier if you give permissions to groups instead of individual users.

• Blank grant: Once permission is set for a group, it applies to all members.
• Membership changes automatically reflected: When a user is added or removed from a group, the user's access rights change immediately.Groups can be granted access to resources such as collections, knowledge, dashboards, and pipelines. For information on how to grant permission, refer to Sharing and Permissions and Authentication and Access Control.

Next steps

document	Description
User Management	User search/creation, group assignment
Authentication and Access Control	Access Permissions (Owner/Editor/Viewer) Model