update sso role mapping doc

Author: Charlie-Boyer

docs/hub/security-sso.md

@@ -62,17 +62,23 @@ This section allows you to define a mapping from your IdP's user profile data fr
 
 - IdP Role Attribute Mapping
 
-  A JSON path to an attribute in your user's IdP profile data.
+- IdP Role Attribute Path
+
+  This is a text input field where you specify the JSON path to an attribute in your user's IdP profile data (e.g., `email`, `groups`, or a custom claim like `custom_roles`). For SAML, if the attribute is a URI reference (e.g., `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role`), the system will directly use the URI as the path.
 
 - Role Mapping
 
-  A mapping from the IdP attribute value to the assigned role in the Hugging Face organization.
+  This section provides a dynamic list of mappings. For each row, you will:
+    - Enter the **IdP Group/Attribute Value**: This is a text input where you type the *exact value* expected from your Identity Provider's attribute (e.g., `admins`, `developers`, `viewers`).
+    - Select the **Hugging Face Role**: This is a dropdown where you choose the corresponding role within the Hugging Face organization (e.g., `admin`, `write`, `read`, `contributor`).
+
+  The system checks if the value extracted from the "IdP Role Attribute Path" either exactly matches one of the "IdP Group/Attribute Value" entries, or if it is an array and one of its elements matches an entry.
 
-You must map at least one admin role.
+  You must map at least one admin role.
 
-If there is no match, a user will be assigned the default role for your organization. The default role can be customized in the `Members` section of the organization's settings.
+  If no mapping is found, a user will be assigned the default role for your organization. The default role can be customized in the `Members` section of the organization's settings.
 
-Role synchronization is performed on login.
+  Role synchronization is performed on login.
 
 #### Resource Group Mapping
 
@@ -85,13 +91,18 @@ When enabled, Resource Group Mapping allows you to dynamically assign members to
 
 - IdP Attribute Path
 
-  A JSON path to an attribute in your user's IdP profile data.
+  This is a text input field where you specify the JSON path to an attribute in your user's IdP profile data (e.g., `department`, `project_access`). For SAML, if the attribute is a URI reference, the system will use the URI directly.
 
 - Resource Group Mapping
 
-  A mapping from the IdP attribute value to a resource group in your Hugging Face organization.
+  This section provides a dynamic list of mappings. For each row, you will:
+    - Enter the **IdP Attribute Value**: This is a text input where you type the *exact value* expected from your Identity Provider's attribute (e.g., `AI_Research`, `ML_Ops`, `Data_Science`).
+    - Select the **Resource Group**: This is a dropdown where you choose an existing resource group within your Hugging Face organization.
+    - Select the **Role Assignation**: This is a dropdown where you choose the access level within the selected resource group (e.g., `admin`, `write`, `read`, `contributor`).
+
+  The system checks if the value extracted from the "IdP Attribute Path" either exactly matches one of the "IdP Attribute Value" entries, or if it is an array and one of its elements matches an entry.
 
-If there is no match, the user will not be assigned to any resource group.
+  If no mapping is found, the user will not be assigned to any resource group.
 
 #### Matching email domains