Add UI Support to View CPD and Identity Provider Group Members

Cloud Pak for Data administrators need a UI-based capability to view group membership for both CPD groups and external identity provider groups, such as Azure Entra ID groups. Currently, administrators do not have a convenient way in the CPD UI to list all users associated with a group, which creates challenges for user onboarding validation, access troubleshooting, and administrative support.

Today, the available workaround is to use the CPD CLI command:
cpd-cli user-mgmt list-groups --profile=${CPD_PROFILE_NAME} --include-members -o json

While this workaround can provide group membership details for CPD groups, it requires CLI access, profile configuration, knowledge of the command syntax, and manual review or parsing of JSON output. This is not ideal for administrators who primarily manage users and groups through the platform UI.

Additionally, for environments using SAML with Just-in-Time provisioning, such as Azure Entra ID integration, CPD only creates users after they log in for the first time. CPD does not retrieve the full list of users from the identity provider group. As a result, expanding or reviewing a group in CPD does not show all expected members from the external identity provider. This makes it difficult for administrators to determine whether a user is missing because they are not assigned to the correct IdP group, or because they simply have not logged in and been provisioned in CPD yet.

The requested enhancement is to add UI functionality within CPD user and group management that allows administrators to view members of both CPD-managed groups and connected identity provider groups. For CPD groups, the UI should display all users currently associated with the selected group. For external identity provider groups, the UI should provide visibility into group membership where supported by the identity provider integration, and clearly distinguish between users who have already been provisioned into CPD and users who exist in the IdP group but have not yet logged in through JIT provisioning.

This feature would improve platform administration by reducing reliance on CLI-based workflows and external identity provider consoles. It would also make user onboarding, access validation, and troubleshooting more efficient by giving administrators a single UI location to review group membership and provisioning status.

Ideally, this enhancement should include the ability to search, filter, sort, and export group membership details, as well as display relevant user attributes such as username, email, display name, provisioning status, and source group type. If full IdP group membership cannot be retrieved due to protocol or integration limitations, the UI should provide clear messaging explaining the limitation.

This functionality is needed to improve administrative visibility, simplify user management, and support more efficient access reviews in CPD environments integrated with enterprise identity providers such as Azure Entra ID.