We are trying to implement dynamic Access Group provisioning via SAML SSO based on roles received in the SAML assertion response.
-
New Operators: When a new user is provisioned via Just-In-Time (JIT) provisioning using a Model Operator, Pega should assign Access Groups based on the SAML assertion roles. The default Access Group should be determined based on role weightage defined in a custom internal table.
-
Existing Operators: When an existing user is granted additional roles in the IdP, their new Access Groups should be assigned upon their very next login.
When implementing this logic inside the Post-Authentication Activity of the Authentication Service rule, the newly assigned Access Groups do not take effect immediately for the active session. The user is required to log out and log back in for the correct Access Groups to be applied.