1. On successful Authentication, the IDP (Identity Provider) responds with a JSON Web Token (JWT), a JSON file containing fields (claims) relative to the user (email, audience, groups, etc.).

   1. The group claims may include:

      • All groups the user belongs to.
      • Filtered groups, depending on configurations applied in the IDP.
   2. NOTE: Please see the following KBA to see how to view the contents of your token: Extract your SSO token on web browser KB
   3. Below is an example of the groups in a typical SSO Token:
       
   4. The groups will be returned as 'federated_groups' when DB-level SSO is cascaded from the Aura Console SSO.
       
2. Neo4j DB then finds the groups that have been listed in the group to role mapping, that are present in the returned results, you can find this information by running the below query:
   

   CALL dbms.listConfig()
   YIELD name, value
   WHERE name CONTAINS "dbms.security.oidc."
     AND name CONTAINS "group_to_role_mapping"
     AND NOT (name CONTAINS "aura-seamless-connection" OR name CONTAINS "k8s")
   RETURN name, value AS `Group to Role Mapping`

3. The logged in user is then assigned the corresponding roles, based on the mapping.
4. If the user is a persistent user in the DB, the user also gets any role manually assigned to him/her.

Further references: