Group Management

Groups organize users and control access to entities and administrative functions. Legend provides system groups for common roles and allows you to create custom groups for fine-grained access control.

Accessing Group Management

To access group management:

1. Click your user menu in the top-right corner
2. Select Admin Panel from the dropdown
3. Click Groups in the admin sidebar

Only users in the Admins group can access group management.

System Groups

Legend provides three system groups that are created automatically and cannot be deleted:

Admins Group

The Admins group grants full administrative access to Legend. Users in this group can:

• Access the admin panel and all administrative functions
• Create and manage users
• Modify system settings
• Manage groups, categories, and tags
• Configure OIDC/SSO integration
• Manage licenses and backups
• Configure alerts and link health monitoring

Default members: The user who completes the initial setup wizard is automatically added to the Admins group.

Admin Access

Ensure at least one user remains in the Admins group at all times. If you remove all users from the Admins group, you will lose access to administrative functions and may need to reset the database to regain admin access.

Users Group

The Users group is the default group for all authenticated users. When a new user account is created, they are automatically added to the Users group.

Users in this group can:

• View all entities they have access to
• Create new entities
• Edit entities they own or have permission to edit
• Delete entities they own
• Manage their own profile

The Users group provides baseline access for all authenticated users. Additional permissions are granted through custom groups or admin privileges.

Editors Group

The Editors group grants enhanced editing permissions. Users in this group can:

• Edit entities they don’t own (if the entity allows group-based editing)
• Create entities in categories that require editor permissions
• Perform bulk operations on entities

The Editors group is useful for users who need to maintain entities owned by others, such as documentation writers or system administrators who aren’t full admins.

Custom Groups

In addition to system groups, you can create custom groups to organize users and control access. Custom groups allow you to:

• Restrict access to specific entities based on group membership
• Grant edit permissions to specific groups
• Synchronize groups from your OIDC provider
• Organize users by team, department, or role

Creating Custom Groups

To create a custom group:

1. Click the Create Group button on the group management page
2. Enter a unique group name (e.g., “Engineering”, “Product Team”, “External Partners”)
3. Enter an optional description explaining the group’s purpose
4. Select the OIDC sync mode (if using OIDC):
   • Manual: Group membership is managed manually in Legend
   • Sync: Group membership is synchronized from your OIDC provider
5. Click Create to create the group

The new group appears in the group list and can be assigned to users immediately.

Editing Groups

To edit an existing group:

1. Find the group in the group list
2. Click the Edit button next to the group name
3. Modify the group’s information:
   • Name (must remain unique)
   • Description
   • OIDC sync mode
4. Click Save to apply the changes

Changes to group properties take effect immediately. Changes to OIDC sync mode may require a synchronization cycle to update group memberships.

Deleting Custom Groups

To delete a custom group:

1. Find the group in the group list
2. Click the Delete button next to the group name
3. Confirm the deletion

What happens when you delete a group:

• The group is permanently removed
• Users who were members of the group lose that membership
• Entity access rules referencing the group are removed
• The group cannot be recovered

System Groups Cannot Be Deleted

The Admins, Users, and Editors groups are system groups and cannot be deleted. Only custom groups can be deleted.

Assigning Users to Groups

Users can belong to multiple groups. To assign a user to a group:

Method 1: From User Management

1. Navigate to Admin Panel > Users
2. Click Edit next to the user
3. In the Groups section, select or deselect groups
4. Click Save

Method 2: From Group Management

1. Navigate to Admin Panel > Groups
2. Click the group name to view group details
3. Click Add Members
4. Select users to add to the group
5. Click Add

Users can be added to or removed from groups at any time. Changes take effect immediately.

How Groups Control Access

Groups control access to entities through two mechanisms:

Access Groups (Read Access)

When you create or edit an entity, you can specify which groups have access to view it. If no access groups are specified, the entity is visible to all authenticated users.

Example:

• Entity: “Confidential Project Plan”
• Access Groups: “Leadership Team”, “Project Managers”
• Result: Only users in the Leadership Team or Project Managers groups can view this entity

If a user is not in any of the specified access groups, they cannot see the entity in search results, the dashboard, or any other view.

Edit Groups (Write Access)

When you create or edit an entity, you can specify which groups have permission to edit it. If no edit groups are specified, only the entity owner and administrators can edit it.

Example:

• Entity: “API Documentation”
• Owner: “Engineering Team”
• Edit Groups: “Documentation Writers”, “Engineering Team”
• Result: Users in the Documentation Writers or Engineering Team groups can edit this entity, even if they don’t own it

Edit groups are useful for collaborative entities where multiple teams need to maintain the content.

Access Control Hierarchy

Access control follows this hierarchy:

1. Administrators: Can always view and edit all entities
2. Entity Owner: Can always view and edit their own entities
3. Edit Groups: Can edit entities where they are in an edit group
4. Access Groups: Can view entities where they are in an access group
5. No Restrictions: If no access or edit groups are specified, all authenticated users can view and owners can edit

OIDC Group Synchronization

If you’re using OIDC/SSO integration, you can synchronize group memberships from your identity provider. This allows you to manage group memberships centrally in your identity provider rather than manually in Legend.

Sync Modes

Manual Mode:

• Group memberships are managed manually in Legend
• OIDC authentication does not affect group memberships
• Useful when your identity provider doesn’t support group claims or when you want fine-grained control

Sync Mode:

• Group memberships are synchronized from your OIDC provider
• When a user logs in, Legend reads their group memberships from the OIDC token
• Users are automatically added to or removed from groups based on the OIDC claim
• Useful for large organizations where group memberships change frequently

Configuring OIDC Sync

To configure OIDC group synchronization:

1. Navigate to Admin Panel > Single Sign-On (OIDC)
2. Configure your OIDC provider settings
3. Set the Groups Claim field to the name of the claim in your OIDC token that contains group memberships (e.g., “groups”, “roles”, “memberOf”)
4. Save the OIDC configuration
5. Navigate to Admin Panel > Groups
6. For each group you want to synchronize, set the OIDC Sync Mode to Sync

When users log in through OIDC, Legend will read their group memberships from the specified claim and update their group memberships accordingly.

Group Name Matching

OIDC group synchronization matches group names exactly. If your OIDC provider returns “Engineering Team” but your Legend group is named “Engineering”, they will not match. Ensure group names are consistent between your OIDC provider and Legend.

Handling Group Changes

When a user’s group memberships change in your OIDC provider:

• New groups: The user is automatically added to the corresponding Legend groups on next login
• Removed groups: The user is automatically removed from the corresponding Legend groups on next login
• Unchanged groups: No changes are made

Group synchronization occurs during the login process. Changes made in your OIDC provider will not take effect in Legend until the user logs in again.

Tier Limits

Community No custom groups

Starter Up to 5 custom groups

Professional Up to 15 custom groups

Business Unlimited custom groups

Legend imposes limits on the number of custom groups based on your license tier:

• Community: No custom groups
• Starter: Up to 5 custom groups
• Professional: Up to 15 custom groups
• Business: Unlimited custom groups

If you reach your tier’s group limit, you cannot create additional custom groups until you upgrade your license or delete existing groups.

System groups (Admins, Users, Editors) do not count against your tier limit.

Best Practices

Group Organization:

• Create groups that reflect your organizational structure (teams, departments, roles)
• Use clear, descriptive group names
• Add descriptions to explain each group’s purpose
• Avoid creating too many overlapping groups

Access Control:

• Start with restrictive access and expand as needed
• Use access groups for sensitive or confidential entities
• Use edit groups for collaborative entities
• Review access control settings periodically

OIDC Synchronization:

• Use sync mode for large organizations with frequent group changes
• Use manual mode for small teams or when you need fine-grained control
• Ensure group names match exactly between your OIDC provider and Legend
• Test synchronization with a few users before enabling it organization-wide

Group Maintenance:

• Review group memberships regularly
• Remove users from groups when they change roles or leave the organization
• Delete groups that are no longer needed
• Document the purpose of each group for future administrators

Troubleshooting

Cannot create group:

• Verify you have administrator privileges
• Check that the group name is unique
• Ensure you haven’t reached your tier’s group limit

OIDC sync not working:

• Verify the groups claim name is correct in your OIDC configuration
• Check that group names match exactly between your OIDC provider and Legend
• Ensure the OIDC token includes the groups claim
• Review the OIDC provider logs for errors

User cannot access entity:

• Verify the user is in the correct access group
• Check that the entity’s access groups are configured correctly
• Ensure the user is logged in and has an active session

User cannot edit entity:

• Verify the user is in the correct edit group
• Check that the entity’s edit groups are configured correctly
• Ensure the user is the entity owner or has edit permissions

Next Steps

After configuring groups, proceed to Categories and Tags to organize your entities, or Branding to customize your Legend instance’s appearance.