[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Managing identity federations > Configuring a federated user group mapping

# Configuring a federated user group mapping

To configure user access to Yandex Cloud resources using [group mapping](../concepts/add-federation.md#group-mapping):

1. [Create user groups](#create-group) in Yandex Identity Hub.
1. [Configure their access permissions](#access) to Yandex Cloud resources.
1. Create user groups in your [identity provider](../concepts/add-federation.md#federation-usage) and add users to them.

    {% note info %}

    You can use existing user groups.

    {% endnote %}

1. Set up user group mapping in the identity provider's SAML attribute settings. To learn how to do this, consult the identity provider's documentation or contact their support.

    Identity providers offer guides on how to set up group mapping:

   * [Keycloak](../tutorials/federations/group-mapping/keycloak.md).
   * [Microsoft Active Directory Federation Services](../tutorials/federations/group-mapping/adfs.md).
   * [Microsoft Entra ID](../tutorials/federations/group-mapping/entra-id.md).
   * [Google](https://support.google.com/a/answer/11143403?sjid=815248229840499495-EU).

1. Set up user group mapping in the federation settings:

    {% note info %}
    
    To configure [user group](../concepts/user-pools.md) mapping on the Yandex Cloud side, [assign](../../iam/operations/roles/grant.md#resource) the user one of the following [roles](../../iam/concepts/access-control/roles.md):
    
    * [`organization-manager.federations.editor`](../security/index.md#organization-manager-federations-editor)
    * [`organization-manager.federations.admin`](../security/index.md#organization-manager-federations-admin)
    * [`organization-manager.editor`](../security/index.md#organization-manager-editor)
    * [`organization-manager.admin`](../security/index.md#organization-manager-admin)
    
    The role must be assigned for the groups you intend to map.
    
    {% endnote %}

    {% list tabs group=instructions %}

    - Cloud Center UI {#cloud-center}

      1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) with an administrator or organization owner account.

      1. In the left-hand panel, select ![VectorSquare](../../_assets/console-icons/vector-square.svg) **Federations**.

      1. Click the line with the required federation and go to the **IdP group** tab.

      1. Enable **Mapping group in IdP**.

      1. Click **Add group** and configure mapping:

          * **Group name**: Enter the name of an identity provider group.
          * **IAM group**: Select a Yandex Identity Hub group from the list.

      1. Repeat the previous step for each group you want to map.

      1. Click **Save**.

    - Terraform {#tf}

      With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
      
      Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
      
      For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

      If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
      
      
      To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

      1. In the Terraform configuration file, describe the resources you want to create:

          ```hcl
          # Enabling federated user group mapping

          resource "yandex_organizationmanager_group_mapping" "my_group_map" {
           federation_id = "<federation_ID>"
           enabled       = true
          }

          # Configuring a federated user group mapping

          resource "yandex_organizationmanager_group_mapping_item" "group_mapping_item" {
            federation_id     = "<federation_ID>"
            internal_group_id = "<Cloud_Organization_group>"
            external_group_id = "<identity_provider_group>"

          depends_on = [yandex_organizationmanager_group_mapping.my_group_map]
          }

          resource "yandex_organizationmanager_group_mapping_item" "group_mapping_item-2" {
            federation_id     = "<federation_ID>"
            internal_group_id = "<Cloud_Organization_group>"
            external_group_id = "<identity_provider_group>"

          depends_on = [yandex_organizationmanager_group_mapping.my_group_map]
          }
          ```

          Where:
          * `federation_id`: Federation ID.
          * `internal_group_id`: Yandex Identity Hub group name.
          * `external_group_id`: Name of an identity provider group.

          For more on the properties of the `yandex_organizationmanager_group_mapping_item` resource, see [this provider guide](../../terraform/resources/organizationmanager_group_mapping_item.md).
      1. Create the resources:

          1. In the terminal, navigate to the configuration file directory.
          1. Make sure the configuration is correct using this command:
          
             ```bash
             terraform validate
             ```
          
             If the configuration is valid, you will get this message:
          
             ```bash
             Success! The configuration is valid.
             ```
          
          1. Run this command:
          
             ```bash
             terraform plan
             ```
          
             You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
          1. Apply the configuration changes:
          
             ```bash
             terraform apply
             ```
          
          1. Type `yes` and press **Enter** to confirm the changes.

          Terraform will create all the required resources. You can check resource availability in the [Cloud Center interface](https://center.yandex.cloud/organization).

    {% endlist %}