Merge pull request #1638 from Infisical/groups

User Groups

docs/documentation/platform/groups.mdx

@@ -0,0 +1,67 @@
+---
+title: "User Groups"
+description: "Manage user groups in Infisical."
+---
+
+<Info>
+    User Groups is a paid feature.
+   
+    If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
+    then you should contact team@infisical.com to purchase an enterprise license to use it.
+</Info>
+
+## Concept
+
+A (user) group is a collection of users that you can create in an Infisical organization to more efficiently manage permissions and access control for multiple users together. For example, you can have a group called `Developers` with the `Developer` role containing all the developers in your organization.
+
+User groups have the following properties:
+
+- If a group is added to a project under specific role(s), all users in the group will be provisioned access to the project with the role(s). Conversely, if a group is removed from a project, all users in the group will lose access to the project.
+- If a user is added to a group, they will inherit the access control properties of the group including access to project(s) under the role(s) assigned to the group. Conversely, if a user is removed from a group, they will lose access to project(s) that the group has access to.
+- If a user was previously added to a project under a role and is later added to a group that has access to the same project under a different role, then the user will now have access to the project under the composite permissions of the two roles. If the group is subsequently removed from the project, the user will not lose access to the project as they were previously added to the project separately.
+- A user can be part of multiple groups. If a user is part of multiple groups, they will inherit the composite permissions of all the groups that they are part of.
+
+## Workflow
+
+In the following steps, we explore how to create and use user groups to provision user access to projects in Infisical.
+
+<Steps>
+   <Step title="Creating a group">
+        To create a group, head to your Organization Settings > Access Control > Groups and press **Create group**.
+        
+        ![groups org](/images/platform/groups/groups-org.png)
+
+        When creating a group, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles.
+        
+        ![groups org create](/images/platform/groups/groups-org-create.png)
+        
+        Now input a few details for your new group. Here’s some guidance for each field:
+        - Name (required): A friendly name for the group like `Engineering`.
+        - Slug (required): A unique identifier for the group like `engineering`.
+        - Role (required): A role from the Organization Roles tab for the group to assume. The organization role assigned will determine what organization level resources this group can have access to.
+   </Step>
+   <Step title="Adding users to the group">
+        Next, you'll want to assign users to the group. To do this, press on the users icon on the group and start assigning users to the group.
+        
+        ![groups org users](/images/platform/groups/groups-org-users.png)
+        
+        In this example, we're assigning **Alan Turing** and **Ada Lovelace** to the group **Engineering**.
+        
+        ![groups org assign users](/images/platform/groups/groups-org-users-assign.png)
+   </Step>
+   <Step title="Adding the group to a project">
+        To enable the group to access project-level resources such as secrets within a specific project, you should add it to that project.
+
+        To do this, head over to the project you want to add the group to and go to Project Settings > Access Control > Groups and press **Add group**.
+        
+        ![groups project](/images/platform/groups/groups-project.png)
+        
+        Next, select the group you want to add to the project and the project level role you want to allow it to assume. The project role assigned will determine what project level resources this group can have access to.
+        
+        ![groups project add](/images/platform/groups/groups-project-create.png)
+        
+        That's it!
+        
+        The users of the group now have access to the project under the role you assigned to the group.
+   </Step>
+</Steps>

docs/documentation/platform/scim/jumpcloud.mdx

@@ -16,7 +16,7 @@ Prerequisites:
 <Steps>
     <Step title="Create a SCIM token in Infisical">
         In Infisical, head to your Organization Settings > Authentication > SCIM Configuration and
-        press the **Enable SCIM provisioning** toggle to allow JumpCloud to provision/deprovision users for your organization.
+        press the **Enable SCIM provisioning** toggle to allow JumpCloud to provision/deprovision users and user groups for your organization.
         
         ![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png)
         
@@ -49,7 +49,7 @@ Prerequisites:
         
         ![SCIM JumpCloud](/images/platform/scim/jumpcloud/scim-jumpcloud-test-connection.png)
         
-        Now JumpCloud can provision/deprovision users to/from your organization in Infisical.
+        Now JumpCloud can provision/deprovision users and user groups to/from your organization in Infisical.
     </Step>
 </Steps>
 

docs/documentation/platform/scim/okta.mdx

@@ -16,7 +16,7 @@ Prerequisites:
 <Steps>
     <Step title="Create a SCIM token in Infisical">
         In Infisical, head to your Organization Settings > Authentication > SCIM Configuration and
-        press the **Enable SCIM provisioning** toggle to allow Okta to provision/deprovision users for your organization.
+        press the **Enable SCIM provisioning** toggle to allow Okta to provision/deprovision users and user groups for your organization.
         
         ![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png)
         
@@ -38,7 +38,7 @@ Prerequisites:
         
         - SCIM connector base URL: Input the **SCIM URL** from Step 1.
         - Unique identifier field for users: Input `email`.
-        - Supported provisioning actions: Select **Push New Users** and **Push Profile Updates**.
+        - Supported provisioning actions: Select **Push New Users**, **Push Profile Updates**, and **Push Groups**.
         - Authentication Mode: `HTTP Header`.
         
         ![SCIM Okta](/images/platform/scim/okta/scim-okta-config.png)
@@ -55,7 +55,7 @@ Prerequisites:
         
         ![SCIM Okta](/images/platform/scim/okta/scim-okta-app-settings.png)
         
-        Now Okta can provision/deprovision users to/from your organization in Infisical.
+        Now Okta can provision/deprovision users and user groups to/from your organization in Infisical.
     </Step>
 </Steps>
 

docs/documentation/platform/scim/overview.mdx

@@ -10,7 +10,7 @@ description: "Learn how to provision users for Infisical via SCIM."
     then you should contact sales@infisical.com to purchase an enterprise license to use it.
 </Info>
 
-You can configure your organization in Infisical to have members be provisioned/deprovisioned using [SCIM](https://scim.cloud/#Implementations2) via providers like Okta, Azure, JumpCloud, etc.
+You can configure your organization in Infisical to have users and user groups be provisioned/deprovisioned using [SCIM](https://scim.cloud/#Implementations2) via providers like Okta, Azure, JumpCloud, etc.
 
 - Provisioning: The SCIM provider pushes user information to Infisical. If the user exists in Infisical, Infisical sends an email invitation to add them to the relevant organization in Infisical; if not, Infisical initializes a new user and sends them an email invitation to finish setting up their account in the organization.
 - Deprovisioning: The SCIM provider instructs Infisical to remove user(s) from an organization in Infisical.

docs/mint.json

@@ -144,7 +144,8 @@
             "documentation/platform/dynamic-secrets/overview",
             "documentation/platform/dynamic-secrets/postgresql"
           ]
-        }
+        },
+        "documentation/platform/groups"
       ]
     },
     {