It is already possible to assign reader groups for JWT users: https://docs.document360.com/docs/jwt-reader-groups Unfortunately the same cannot be done for OpenID (or SAML for that matter), which can make it a huge effort to keep groups and access control in sync across different systems. For us, it would be very beneficial, if we could deliver the Reader Group IDs from our SSO system, exactly like it is done for JWT. In the case of OpenID, we would just deliver an extra "readerGroupIds" claim in the ID-Token that Document360 could then read when signing the user in. There are other Document360 users here, who have asked for similar features already: "Allow domain-to-reader group mapping for SSO self registration" (7 votes) https://feedback.document360.com/feature-request/p/allow-domain-to-reader-group-mapping-for-sso-self-registration "OpenID - Map email domain to reader group" (3 votes) https://feedback.document360.com/feature-request/p/openid-map-email-domain-to-reader-group "Auto assign SSO users to reader group based on conditions" (5 votes) https://feedback.document360.com/feature-request/p/auto-assign-sso-users-to-reader-group-based-on-conditions ---- Adding application-specific claims to the ID Token seems to be relatively standard practice. For example, we're currently rolling out another tool, Bettermode, and they support a similar workflow to assign users to "spaces" (you can think of them as sub-forums). The process is documented here: https://developers.bettermode.com/docs/guide/single-sign-on/oauth2-sso/#user-profile-url