From 7ac0a64dbb2ba8c82bddc22a435cf605c28b96d8 Mon Sep 17 00:00:00 2001 From: huggingface-doc-bot Date: Thu, 21 May 2026 12:38:48 +0000 Subject: [PATCH] Update SSO role mapping doc: most privileged role wins on multi-match When an IdP attribute matches several role mappings (e.g. user belongs to multiple groups), the assigned role is now the highest-privileged match rather than the first match encountered. --- docs/hub/security-sso-user-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/hub/security-sso-user-management.md b/docs/hub/security-sso-user-management.md index 77630d091e..a08a27aabc 100644 --- a/docs/hub/security-sso-user-management.md +++ b/docs/hub/security-sso-user-management.md @@ -39,7 +39,7 @@ This section allows you to define a mapping from your IdP's user profile data to > [!WARNING] > You must map at least one `admin` role in your configuration. -If the attribute in the IdP response contains multiple values (e.g. a list of groups), the **first matching mapping** will be used to determine the user's role. +If the attribute in the IdP response contains multiple values (e.g. a list of groups) that match several mappings, the user is assigned the **most privileged matching role**. The role hierarchy, from least to most privileged, is `read` < `contributor` < `write` < `admin`. If there is no match, the role is determined as follows: