Table of Contents

Default groups Linked groups Configuring a linked group Example: Mapping AD groups to FotoWeb groups in Microsoft ADFS How are groups synchronized? Example: Microsoft Entra ID Example: How do you assign different user licenses to different user groups?

Managing groups using SAML

28. August 2026

Table of Contents

When managing groups with SAML (Security Assertion Markup Language), there are two options available, both of which are described below. These two options can be combined.

Default groups

When users log in via SAML SSO, they are added to all default groups and receive their corresponding permissions and user licenses.

These groups are configured in FotoWeb's SAML settings interface in the Site Configuration: Default groups and Linked groups.

From the Tools menu (cogwheel icon), go to Site Configuration > Security > Single Sign-on.
By defining at least one default group, all users who log in via SAML will be granted access and placed in these default FotoWeb groups upon import.

The Default groups section of the FotoWeb Single Sign-on settings, showing one default group named SAML and the Add new default group button.

For example, you can create a SAML Users group in FotoWeb and add it as a default group. All users who log in via SAML SSO are added to this group and granted access to the system accordingly. All users are automatically added to the Everyone and Registered users groups.

Linked groups

Linked groups are groups to which users who log in with SAML SSO are conditionally added. This means that users become members of these groups and receive their permissions and user licenses accordingly if their user properties, provided by the identity provider, match specific conditions.

On the Linked Groups tab, you find FotoWeb groups that are linked to groups in the SAML Identity Provider (IdP). When using ADFS, the IdP will be Active Directory.
When a user logs in with SAML SSO, that user will be added to one or more linked groups based on the group information obtained from the IdP.

For example, you can create a group called FW-Editors in FotoWeb and configure it as a linked group (Select Add linked group) so that all members of the Active Directory group AD-Editors are added to the corresponding FW-Editors group in FotoWeb when they log in. This way, groups can be managed in the IdP, synced to FotoWeb, and used for fine-grained access control based on group membership or other attributes set in the IdP.

Configuring a linked group

Create a group in FotoWeb.
Set the group permissions, the license to apply to the group, and any parent group that the group should be nested in.
Link the FotoWeb group to the corresponding SAML group in Site Configuration > Security > Single Sign-on > Linked Groups, then select Add linked group.
In External Group ID (referred to in earlier versions as the SAML group name), enter the attribute value provided by the identity provider (the groups attribute, or the attribute assigned to the Member Of property) and not the display name of the group in the IdP.
In Group Name, select the FotoWeb group you created above. If your identity provider is Microsoft Entra ID, see Example: Microsoft Entra ID for the value that Entra sends.
In the Identity Provider, configure an attribute mapping rule for group membership(s) that maps group names to the attribute value. For more information, see SAML - Fotoware Attribute Mapping.

How to perform this step depends on the Identity Provider. For example, in Microsoft ADFS, you can:

Add a claim rule (which is called an attribute mapping in SAML) of type Send group membership as claim,
Select an Active Directory group to be linked to the FotoWeb group,
Set the outgoing claim type (= SAML attribute mapping) to Groups (or whatever SAML Property name is used for the FotoWeb Member of (Group) property) and set the outgoing claim value to the same value as the External Group ID for the group in FotoWeb.

This is described below. For additional information from Microsoft, see https://docs.microsoft.com/en-us/win...hip-as-a-claim.

Renew certificates before they expire

The certificates used for SAML SSO must be renewed before they expire, otherwise users will temporarily lose access to the system. Each customer is responsible for avoiding this situation. We recommend setting reminders and designating responsibility so that there is always someone available to renew the certificates when necessary.

In the following, ADFS is used to illustrate the attributes that need to be mapped. However, the same can be accomplished by configuring FotoWeb to use a SAML interface with other Identity Providers.

Example: Mapping AD groups to FotoWeb groups in Microsoft ADFS

In the ADFS manager, right-click the selected trust and select Edit Claim Issuance Policy.
The Claim Issuance Policy window opens. Add one rule for every group you'd like to link to FotoWeb.

About the rules in the example

In the example above, Entry 3 in the list is the group claim. You can find information on setting up entries 1 and 2 (LDAP and Name ID mapping) below.

Select Add Rule to create a new rule.
From the Claim rule template dropdown list, choose Send Group Membership as a Claim.
Enter the rule specifics:

Claim rule name is used to identify the rule. Give it a name that you can easily identify later.
Choice of group: Choose the group to sync to FotoWeb. Select Browse to select a group in the Identity Provider (AD).
User's group: Do not select a value from the dropdown list; instead, enter the SAML Attribute Name corresponding to the FotoWeb Member of (Groups) property - it's typically called groups unless you've changed the default value. This allows FotoWeb to identify the transferred claim as a group attribute.
Outgoing claim value: Here, enter a unique name that will be used to identify the group when linking it to a group in FotoWeb. It does not need to have the same name as the group; the value must match the External Group ID specified for the FotoWeb group. (adfs_editors was used in the example FotoWeb group above - the example below reflects this.)

The completed group claim rule in ADFS, with the outgoing claim type set to groups and the outgoing claim value set to adfs_editors.

You can also specify multiple groups in the groups attribute, separated by commas. For example, a value of group1,group2 will add the user to the linked groups with the External Group ID group1 or group2. How to set the attribute like this depends on the Identity Provider. To our knowledge, it is not easily possible in ADFS.

How are groups synchronized?

Upon login, the user will be removed from any linked groups whose External Group ID is not listed in the groups attribute. This allows an administrator to revoke a user's access to resources in FotoWeb by, for example, removing the user from a group in Active Directory. The user is never removed from groups with no External Group ID (FotoWeb groups that are not linked groups).

A user can log in to FotoWeb via SAML SSO if and only if the user is added to at least one linked group, or if at least one default group is configured.

If any default groups are configured, all users who can successfully sign in via SAML SSO have permission to log in to FotoWeb. If no default groups are configured, then membership of linked groups can be used to control access to FotoWeb in general. Note that most SAML Identity Providers also support configurable access control, so it is possible to configure it even when using default groups.

Example: Microsoft Entra ID

FotoWeb does not look up your groups in Entra ID. It compares the values in the group claim that Entra sends at sign-in against the External Group ID of each linked group, so the value you enter must be exactly what Entra sends.

What Entra sends depends on the Source attribute chosen for the group claim on the FotoWeb enterprise application:

Source attribute in Entra ID	Enter this as the External Group ID
Group ID	The group's Object ID, a GUID such as `8a5b1c94-3f2d-4e77-b0a1-6d9c2f31e8ab`
Cloud-only group display names	The group's name, such as `Marketing`

To find a group's Object ID: in the Microsoft Entra admin center, go to Groups > All groups, select the group, and copy the Object ID from its Overview page. Paste it into External Group ID when you add the linked group in FotoWeb, and save. Repeat for each group you want to link.

The group must also be included in the group claim. If the claim is limited to Groups assigned to the application, assign the group to the FotoWeb enterprise application as well, or its members will not receive the claim.

For information on configuring the claim itself, see Setting up SSO with Microsoft Entra ID.

If users authenticate successfully but end up in no group, or the wrong one, the value FotoWeb received did not match any External Group ID. Check, in this order:

Which Source attribute the group claim uses in Entra - Object IDs and group names are not interchangeable.
That the External Group ID matches that value exactly, with no leading or trailing spaces.
That the group is in scope of the claim - if the claim is limited to groups assigned to the application, the group must be assigned to it.

Example: How do you assign different user licenses to different user groups?

Based on the information above, here's an example illustrating how to control the assignment of user licenses (Main, Pro, Standard (Legacy) by group membership in the IdP. Note that the example is based on FotoWeb Feature Release 13 or later; it won't work with earlier versions.

Create a group AD Pro Users in Active Directory and add all users/groups that should receive a Pro license.
Create a group FW Pro Users in FotoWeb and set the default license to Pro.
Set the External Group ID of the FotoWeb group to pro_users.
Link the FotoWeb group to the corresponding SAML group in Site Configuration > Security > Single Sign-on > Linked Groups.
In ADFS, create a new Send Group Membership as a Claim rule.
Select the AD group AD Pro Users.
Set Outgoing claim type (= SAML Attribute name) to groups (enter the value; do not select from the dropdown list).
Set Outgoing claim value to pro_users.

Licenses can now be managed in AD by adding/removing users/groups to/from the AD Pro Users group.

The names and identifiers can be varied. The examples above are chosen as placeholders to illustrate which names must match and which need not.