Show TOC

Mapping SAML 2.0 AttributesLocate this document in the navigation structure

Use

The Security Assertion Markup Language (SAML) 2.0 assertion should include all the attributes you need for the user in the service provider. Exactly what is transported is a matter of negotiation between you and the operator of the identity provider. The identity provider sends the attributes as attribute=value pairs. You need to know the name of the SAML 2.0 attribute and what kind of value it carries so you can map it to user attributes in AS Java. If the SAML 2.0 assertion includes all the required attributes, the service provider creates a user in memory and populates the mapped profile attributes with values. Use this procedure to define how this mapping defines users and their access rights.

Prerequisites
Procedure

You can configure the following:

  • Default user attributes

  • Assertion-based user attribute mappings

  • Assertion-based role and group assignments

  • Default user role and group assignments

Assigning Default User Attributes

Default user attributes are always assigned to users once the SAML authentication is successful.

  1. On the Default User Attributes tab, choose the Add pushbutton.

  2. Select a user attribute from the list of predefined user attributes.

  3. Enter the value for the attribute.

  4. Choose OK .

  5. Add additional attributes as needed.

  6. Save your entries.

Assigning Assertion-Based User Attributes

  1. On the Assertion-Based User Attributes tab, choose the Add pushbutton.

  2. Enter the following data:

    Parameter

    Entry

    SAML2 Attribute

    Name of the attribute as sent by the identity provider in the SAML 2.0 assertion.

    User Attribute

    Name of the AS Java user attribute. Choose from the predefined user attributes list.

    Is Mandatory

    If you want the service provider to require this attribute (reject the SAML assertion if this attribute is missing), select this option.

  3. Add additional attributes as needed.

  4. Save your entries.

Assigning Assertion-Based User Roles and Groups

SAML 2.0 attributes can also carry information about role or group membership. Based on the value of a SAML 2.0 attribute, the service provider can assign groups or roles to a user. In this way, the administrator of the identity provider can determine the access rights of the users, from the roles and groups you provide.

  1. On the Assertion-Based User Roles tab or the Assertion-Based User Groups tab, choose the Add pushbutton.

  2. Choose the Modify pushbutton

  3. Choose the Add pushbutton.

  4. Enter the following data:

    Parameter

    Entry

    SAML2 Attribute

    Name of the attribute sent by the identity provider carrying the role or group membership information.

    Value

    Enter the value to map to specific roles or groups.

  5. Choose the Browse pushbutton.

  6. Search for the role or roles or the group or groups to assign to the user when the assertion includes the SAML 2.0 attribute with the defined value.

  7. Save your entries.

Assigning Default User Roles and Groups

You can assign roles and groups to which all users belong by default. These are in addition to the built-in groups Everyone, Anonymous Users, and Authenticated Users, and any roles assigned to these built-in groups. In this way, you can determine what access rights all users are granted by default.

  1. On the Default User Roles tab or the Default User Groups tab, choose the Modify pushbutton.

  2. Search for groups or roles and choose the Add pushbutton.

  3. Save your entries.

More Information