#1180 Santa: assign tags from identity provider groups Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Workshop maps IdP groups to tags, so rules follow department membership. osctrl tags are managed manually or via osquery. Scope • Map a node to its primary user (from Santa's

primary_user

at preflight) and that user to IdP groups (from OIDC/SAML claims or SCIM). • Configurable group-to-tag mapping per environment; tags applied automatically and removed when membership changes. • Decide whether to sync via SCIM or at login only. Acceptance • Moving a user between IdP groups changes the node's tags and its effective Santa rules on next sync. jmpsec/osctrl