User Group identifier for MCP Identity Gateway now available
A Client Workload can now match MCP Identity Gateway users by the groups they belong to in an OIDC Identity Provider.
Use the User Group identifier to limit an MCP server to the members of a team, such as engineering or every
group that starts with finance-.
See User Group.
- Group lookup - Turn on User Groups & MCP Policy Access on an OIDC 1.0 Identity Provider to set the group claim and the cache time. See Configure user group lookup.
- UserInfo requests - When the sign-in tokens carry no group claim, Aembit requests it from the Identity Provider’s UserInfo endpoint.
- Names and patterns - Each User Group value names an Identity Provider and a group name or a pattern that uses
*, matched case-sensitively against the whole group name. - More than one Identity Provider - A user needs to match any one User Group value, so one Client Workload can serve users from two Identity Providers.
- Group refresh - After the cache time passes, Aembit refreshes a user’s groups from UserInfo in the background. See When changes take effect.
- Removed groups - When UserInfo answers without the group claim, Aembit clears the user’s stored groups. When a UserInfo request fails, Aembit keeps the last stored groups.
- UserInfo health - The Identity Provider’s Details tab shows the UserInfo Health (Last 24 Hours) card. See Check group lookup health.