I’m figuring out how to allow the same user to access multiple GoodData workspaces with the combination of users and their groups. In our application we also have a concept of a workspace. User with the same authentication id can access multiple workspace. However user’s

id

is workspace specific. So when I create the users to the GoodData, my structure looks something like this where user id is different but they share the same authenticationId.

{
	"id": "user-id-1",
	"type": "user",
	"attributes": {
		"authenticationId": "auth-id-abc"
	}
},
{
	"id": "user-id-2",
	"type": "user",
	"attributes": {
		"authenticationId": "auth-id-abc"
	}
},

As a result, when I login to GoodData with my authenticationId “auth-id-abc”, it seems like GoodData shows me only one workspace quite randomly. What is the GoodData best practice of assigning single user to multiple workspaces?

Hi Jani, Are you working with GoodData Cloud and OIDC? Or what exactly is your current setup, please?

At the moment just for testing we use the docker container version but otherwise GoodData Cloud yes. And OIDC through Auth0

authenticationId must be unique within one organization. This attribute is used for deciding what gooddata user actually logged in. If you have one authenticationId assigned to multiple users, the result is undefined. You need to adjust your user mapping so that one person (identitfied by unique authenticationId) must be mapped to one gooddata user. Users can be later granted to particular workspaces using permissions model.

Ok makes sense. I just need to figure what could the user’s

id

be in our case cause the authenticationId is not in the format that is accepted as

id

But this info is enough for me, thank you for clarification.

Once you standardize this back to single id to single authenticationid, this should work as you expect, I use the model of creating groups per-workspace, and I just add the user to each group to grant them access. This works as expected and they are able to see all workspaces they are members of the access groups for.

As you have full control over user's

id

value, it's upto you. It can also be generated as

md5sum(authenticationId)

to guarantee 1:1 mapping between authId and Id.

In my case I need to use authenticationId so md5sum might be the best way to go