If a SAML user belongs to multiple groups with competing roles, Minimus will assign the highest available role. The calculation is done at runtime.Assigning the highest role provides a clear and predictable method for resolving overlapping permissions. This approach prevents accidental loss of required access and avoids ambiguity. It also simplifies permission evaluation and makes access configurations easier for administrators and users to understand.
Group membership cannot reduce a user’s permissions. You can be confident that adding an existing SAML user to another group will not unintentionally reduce their role.
Typically, SAML user roles are managed via groups. However, you have the option to elevate a specific user’s role independently of any group. Instructions
