**As** an OpenProject admin
**I want** users' groups to be synchronized on login
**so that** I can control their group memberships in my identity Begin of the insertionprovider, especially when self-registering is desirable.End of the insertion Begin of the deletion provider.End of the deletion

Begin of the insertion<br>

End of the insertion **Acceptance criteria**

* allow requesting group claims (cf. [OpenID Connect claims in OpenProject](https://www.openproject.org/docs/installation-and-operations/misc/custom-openid-connect-providers/#claims), [configuring group claims in okta](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/#request-a-token-that-contains-the-custom-claim)) Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * evaluate group claims on login Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * synchronize groups between OpenProject and IdP (identity provider) in some way (e.g. simple name-based matching) Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * assign user to groups passed in groups claim Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion * note: in the case of MS Entra ID (formerly Azure AD) the number of groups in the group claim [is apparently limited to 150](https://docs.gitlab.com/ee/user/group/saml_sso/group_sync.html#microsoft-azure-active-directory-integration))