Federated database user mapping by sub/groups claim
Parent: Atlas Identity Federation and Resource Policy Boundaries · Published reference · snapshot 2026-10-15
↓ Facts as markdownall context files
Depth-first rabbithole dossier for Federated database user mapping by sub/groups claim; source-anchored research pack.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- [low] The `sub` claim is a unique pair-wise value based on the token recipient, tenant, and user, so two apps requesting ID tokens for the same user receive different `sub` claims but the same `oid` claims. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference [source]
- [low] The `oid` claim is a non-reusable GUID, and if a user exists in multiple tenants, they have a different object ID in each tenant, considered different accounts despite same credentials. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference [source]
How it works
- [low] When creating role mappings in Atlas, the Azure group data sent in the SAML response must exactly match the configured Atlas role mapping name. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
Comparisons and alternatives
- [low] Entra ID supports writing group names in the `memberOf` claim instead of GUIDs. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
Facts and statements
- [low] MongoDB Atlas limits each database user to 100 assigned roles, each organization to $50 hourly billing, and each project to 25 federated database instances. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
- [low] MongoDB Atlas limits each project to 100 database users and 500 Atlas users, while each organization is limited to 500 Atlas users and 500 API keys. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
- [low] Configure the Name to `memberOf`, clear Emit groups as role claims, set Request Binding to HTTP POST, and set Response Signature Algorithm to SHA-256. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
- [low] MongoDB Atlas limits each team to 250 users, each project to 100 teams, each organization to 250 teams, and each user to 100 teams and 250 organizations. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
- [low] Managing federated authentication requires Organization Owner access to organizations delegating federation settings to the instance. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
- [low] Configuring Microsoft Entra ID integration requires at least Cloud App Administrator and User Administrator privileges in the Microsoft Entra ID tenant. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
- [low] The `name` claim provides a human-readable, non-unique, changeable value for display purposes only. Sources: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference [source]
- [low] Before testing, copy and save the Bypass SAML Mode URL for the IdP to bypass federated authentication if locked out of the Atlas organization, and keep the session logged in to the Federation Management Console to prevent lockouts. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-azure-ad.md [source]
Related concepts
- user — is a part of Federated database user mapping by sub/groups claim
- claim — is a part of Federated database user mapping by sub/groups claim
- Federated — is a part of Federated database user mapping by sub/groups claim
- database — is a part of Federated database user mapping by sub/groups claim
- mapping — is a part of Federated database user mapping by sub/groups claim
- sub — is a part of Federated database user mapping by sub/groups claim
- groups — is a part of Federated database user mapping by sub/groups claim
Children
- No children recorded.