# Notifications

## What Will You Do

In this section, you will use the previously created IDP user to test the permissions of the associated IDP group. The IDP group inherits its permissions by sharing the name with an existing group in the Rafay console. You will then create a group with different permissions in the Rafay console. This group will then be assigned to the IDP user within the Rafay console. The IDP user will then be associated with two groups, one from the matching IDP group and the other from the locally assigned group. The IDP user will have a union of the two associated group's permission sets.

---

## Step 1: Test IDP User

In this step, we will test the permissions of the IDP user associated with the IDP group.

- Navigate to the Rafay console
- Login with the previously created IDP user account

- Click **Login With SSO**

- Enter your IDP credentials
- Click **Sign in**

You will then be logged into the Rafay console with the IDP user.

- Click on **New Project**
- Enter a name
- Click **Create**

You will see that you are unable to create a new project as you do not have the required permissions with the IDP user account. The user is associated with the "Organization Read Only" group which has read-only permissions.

- Click on **defaultproject**
- Click **Infrastructure -> Blueprints**
- Click **New Blueprint**
- Enter a name for the blueprint
- Click **Save**

You will see that you are unable to create a blueprint with the IDP user account as it only has read-only permissions.

---

## Step 2: Create Local Group

In this step, we will create a local group in the Rafay console with infrastructure administrator privileges and add the IDP user to the group. Since the IDP user that was previously created only has read-only permissions, we will need to use an account with Organization Administrator privileges.

- Navigate to the Rafay console
- Login with an Organization Administrator account
- Click on **System -> Groups**
- Click **New Group**
- Enter the name **InfraAdmin**
- Click **Create**

- On the **Users** tab, click **Add/Remove Members**
- Select **IDP Users**
- Select the previously created IDP user
- Click **Add to Group**
- Click **Save & Exit**

- Click **Continue** to confirm adding the user to the group

- Click on the **Projects** tab
- Click **Assign Group To Project**

- Under **Select Project**, select **defaultproject**
- Under **Select Roles**, select **Infrastructure Admin**
- Click **Save & Exit**

---

## Step 3: Check IDP User Groups

In this step, we will check the groups that are associated with the IDP user.

- Navigate to the Rafay console
- Login with an Organization Administrator account
- Click on **System -> Users**
- Click on the **Manage Groups** icon next to the IDP user

At the top of the window, you will see the IDP groups associated with the user. On the lower portion of the window, you will see the local groups associated with the user. In this scenario, the Organization Read Only group was inherited through the IDP group association and the InfraAdmin group was assigned locally. We know the InfraAdmin group was assigned locally as it is not listed in the IDP Groups section at the top of the window.

---

## Step 4: Test IDP User with Local Group

In this step, we will test the newly added permissions of the IDP user that is now associated with a local group that has Infrastructure Admin privileges on the default project.

- Navigate to the Rafay console
- Login with the previously created IDP user account
- Click on **New Project**
- Enter a name
- Click **Create**

You will see that the user still does not have permissions for organizational level changes.

- Click on **defaultproject**
- Click **Infrastructure -> Blueprints**
- Click **New Blueprint**
- Enter a name for the blueprint
- Click **Save**
- Enter a version name
- Click **Save Changes**

You will see that you are now able to create a blueprint with the IDP user account as it now has Infrastructure Administrator permissions.

---

## Recap

In this part, you tested both IDP and local group permissions assigned to an IDP user to see how the union of the groups' permissions functioned.