Specifications for SAML attribute statement values - Identity as a Service

This topic describes the specifications for configuring values in SAML attribute statements and provides configuration examples.

Attribute statement values

Type	Value	Description
variable	`user.username`	The username.
	`user.displayName`	The display name.
	`user.phone` (deprecated)	The mobile phone number, excluding the country code (deprecated).
	`user.phoneNumber`	The mobile phone number, excluding the country code.
	`user.email`	The email address.
	`user.status`	The user status. Valid values: `enabled` `disabled`
	`user.primaryOrganizationalUnitId`	The ID of the user's primary organizational unit.
	`ObjectToJsonString(user.organizationalUnits)`	The organizational units to which the user belongs. Format: JSON array string.
	`ArrayJoin(ArrayMap(user.organizationalUnits, __item.organizationalUnitId), ",")`	The IDs of the organizational units to which the user belongs. Format: Comma-separated string.
	`ObjectToJsonString(user.groups)`	The groups to which the account belongs. Format: JSON array string.
	`ArrayJoin(ArrayMap(user.groups, __item.groupId), ",")`	The IDs of the groups to which the account belongs. Format: Comma-separated string.
	`ArrayJoin(ArrayMap(user.groups, __item.groupExternalId), ",")`	The external IDs of the groups to which the account belongs. Format: Comma-separated string.
	`ObjectToJsonString(user.customFields)`	All custom fields. Format: JSON array string.
	`user.customFieldMap.$fieldname$.fieldValue`	The value of a custom field. Replace $fieldname$ with the field name.
	`appUser.username`	The application account.
constant	A fixed string. Enclose the value in double quotation marks ("").
expression	An advanced feature that lets you flexibly concatenate and transform values. For more information, see advanced account field expressions.

SAML expression examples

Sample user object

{
  ...
  "customFieldMap": {
        "place": {
            "fieldName": "place",
            "fieldValue": "beijing"
        },
        "age": {
            "fieldName": "age",
            "fieldValue": "18"
        }
    },
    "identityProviderUserMap": {
        "idp_m2gngriuenktdkxxxxxx": {
            "identityProviderId": "idp_m2gngriuenktdkxxxxxx",
            "identityProviderType": "ding_talk",
            "identityProviderExternalId": "corp_1234xxxxxxx",
            "identityProviderUserId": "b2ed5fc0xxxxx"
        }
    },
    "organizationalUnits": [
        {
            "organizationalUnitId": "ou_sdfadtaaxxxxxx",
            "organizationalUnitName": "AD",
            "primary": false
        },
        {
            "organizationalUnitId": "ou_werttxxxxxx",
            "organizationalUnitName": "name_002",
            "primary": true
        }
    ],
    "primaryOrganizationalUnitId": "ou_werttxxxxxx",
    "customFields": [
        {
            "fieldName": "place",
            "fieldValue": "beijing"
        },
        {
            "fieldName": "age",
            "fieldValue": "18"
        }
    ],
    "groups": [
        {
            "groupId": "group_jp6al4sn4n4wjgjxxxxxx",
            "groupName": "group1",
            "groupExternalId": "group_jp6al4sn4n4wjgjxxxxxx"
        },
        {
            "groupId": "group_vavikcxewkf5h3oxxxxxx",
            "groupName": "group2",
            "groupExternalId": "group_vavikcxewkf5h3oxxxxxx"
        }
    ],
  ...
}

Example SAML console configuration

On the SAML application configuration page, for Signing Algorithm, select SHA256 (only RSA-SHA256 is supported). In the Attribute Statements section, configure the following attribute mappings: organizationalUnits → ObjectToJsonString(user.organizationalUnits), organizationalUnitIds → ArrayJoin(ArrayMap(user.organizationalUnits, __item.organizationalUnitId), ","), groups → ObjectToJsonString(user.groups), groupIds → ArrayJoin(ArrayMap(user.groups, __item.groupId), ","), groupExternalIds → ArrayJoin(ArrayMap(user.groups, __item.groupExternalId), ","), groupIdArray → SamlArray(ArrayMap(user.groups, __item.groupId)), customFields → ObjectToJsonString(user.customFields), and age → user.customFieldMap.age.fieldValue. This configuration returns these additional user fields in the SAML response, which the application can then parse. For SSO initiator, select Support portal and application initiated. This allows users to initiate SSO from either the Alibaba Cloud IDaaS portal page or the application.

Resulting SAML assertion examples

The expression ObjectToJsonString(user.organizationalUnits) generates the following SAML assertion:

<saml2:Attribute Name="organizationalUnits" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    [{"organizationalUnitId":"ou_sdfadtaaxxxxxx","organizationalUnitName":"AD","primary":false},{"organizationalUnitId":"ou_werttxxxxxx","organizationalUnitName":"name_002","primary":true}]
  </saml2:AttributeValue>
</saml2:Attribute>

The expression ArrayJoin(ArrayMap(user.organizationalUnits, __item.organizationalUnitId), ",") generates the following SAML assertion:

<saml2:Attribute Name="organizationalUnitIds" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    ou_sdfadtaaxxxxxx,ou_werttxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

The expression ObjectToJsonString(user.groups) generates the following SAML assertion:

<saml2:Attribute Name="groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    [{"groupId":"group_jp6al4sn4n4wjgjxxxxxx","groupName":"group1","groupExternalId":"group_jp6al4sn4n4wjgjxxxxxx"},{"groupId":"group_vavikcxewkf5h3oxxxxxx","groupName":"group2","groupExternalId":"group_vavikcxewkf5h3oxxxxxx"}]
  </saml2:AttributeValue>
</saml2:Attribute>

The expression ArrayJoin(ArrayMap(user.groups, __item.groupId), ",") generates the following SAML assertion:

<saml2:Attribute Name="groupIds" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    group_jp6al4sn4n4wjgjxxxxxx,group_vavikcxewkf5h3oxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

The expression ArrayJoin(ArrayMap(user.groups, __item.groupExternalId), ",") generates the following SAML assertion:

<saml2:Attribute Name="groupExternalIds" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    group_jp6al4sn4n4wjgjxxxxxx,group_vavikcxewkf5h3oxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

The expression SamlArray(ArrayMap(user.groups, __item.groupId)) generates the following SAML assertion:

<saml2:Attribute Name="groupIdArray" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:type="xsd:string">
    group_jp6al4sn4n4wjgjxxxxxx
  </saml2:AttributeValue>
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    group_vavikcxewkf5h3oxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

The expression ObjectToJsonString(user.customFields) generates the following SAML assertion:

<saml2:Attribute Name="customFields" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:type="xsd:string">
    [{"fieldName":"place","fieldValue":"beijing"},{"fieldName":"age","fieldValue":"18"}]
  </saml2:AttributeValue>
</saml2:Attribute>

The expression user.customFieldMap.age.fieldValue generates the following SAML assertion:

<saml2:Attribute Name="age" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    18
  </saml2:AttributeValue>
</saml2:Attribute>