How do I map an IdP group to be Moodle admins?

[bdruth]

Apologies, but I'm not entirely grokking the group rules. My goal (at this point) is simple - I have a group defined in the IdP, being passed over, and I want members of that group to be considered site admins. What's the most straightforward way to do that? e.g. my IdP group comes over as moodle-admins.

    "Groups": [
        "moodle-admins"
    ],

[kabalin]

Hello @bdruth, the IdP setting "For admin users only" allows to make every user an admin for IdP. I guess you have non-admin users too, in that case the way to differentiate would be to create two IdPs at SAML end (plugin supports multiple IdPs), one would be for admins only, and another one for all other users. I don't see any other option to achieve that, may be someone has different idea.

[bdruth]

Gotcha, thanks, I'll take a look at that!

Edit: one problem with this might be that Google Workspace doesn't allow the same Entity ID to be setup across SAML apps? I'll see if there's any way around that.