Specifications for SAML Attribute Statements values - Identity as a Service

This topic describes how to specify extended values for SAML Attribute Statements in the SAML standard protocol and provides configuration examples.

Specifications for SAML extended values

Type	Value	Description
Variable	user.username	Username.
	user.displayName	Display name.
	user.phone (deprecated)	Mobile phone number, excluding the country code (deprecated).
	user.phoneNumber	Mobile phone number, excluding the country code.
	user.email	Email address.
	user.status	User status. Valid values: enabled. disabled.
	user.primaryOrganizationalUnitId	ID of the primary organizational unit to which the user belongs.
	ObjectToJsonString(user.organizationalUnits)	All information about the organizational units to which the user belongs. Format: JSON array string.
	ArrayJoin(ArrayMap(user.organizationalUnits, __item.organizationalUnitId), ",")	List of IDs of the organizational units to which the user belongs. Format: JSON array string.
	ObjectToJsonString(user.groups)	All information about the groups to which the account belongs. Format: JSON array string.
	ArrayJoin(ArrayMap(user.groups, __item.groupId), ",")	List of IDs of the groups to which the account belongs. Format: JSON array string.
	ArrayJoin(ArrayMap(user.groups, __item.groupExternalId), ",")	List of external IDs of the groups to which the account belongs. Format: JSON array string.
	ObjectToJsonString(user.customFields)	All information about the custom fields. Format: JSON array string.
	user.customFieldMap.$fieldname$.fieldValue	Value of a specific custom field.
	appUser.username	The application account.
Constant	Use double quotation marks ("") and specify the constant between them.
Expression	An advanced feature that lets you flexibly concatenate and transform values. For details, see Advanced account field expressions.

SAML expression examples

User object input example

{
  ...
  "customFieldMap": {
        "place": {
            "fieldName": "place",
            "fieldValue": "beijing"
        },
        "age": {
            "fieldName": "age",
            "fieldValue": "18"
        }
    },
    "identityProviderUserMap": {
        "idp_m2gngriuenktdkxxxxxx": {
            "identityProviderId": "idp_m2gngriuenktdkxxxxxx",
            "identityProviderType": "ding_talk",
            "identityProviderExternalId": "corp_1234xxxxxxx",
            "identityProviderUserId": "b2ed5fc0xxxxx"
        }
    },
    "organizationalUnits": [
        {
            "organizationalUnitId": "ou_sdfadtaaxxxxxx",
            "organizationalUnitName": "AD",
            "primary": false
        },
        {
            "organizationalUnitId": "ou_werttxxxxxx",
            "organizationalUnitName": "name_002",
            "primary": true
        }
    ],
    "primaryOrganizationalUnitId": "ou_werttxxxxxx",
    "customFields": [
        {
            "fieldName": "place",
            "fieldValue": "beijing"
        },
        {
            "fieldName": "age",
            "fieldValue": "18"
        }
    ],
    "groups": [
        {
            "groupId": "group_jp6al4sn4n4wjgjxxxxxx",
            "groupName": "group1",
            "groupExternalId": "group_jp6al4sn4n4wjgjxxxxxx"
        },
        {
            "groupId": "group_vavikcxewkf5h3oxxxxxx",
            "groupName": "group2",
            "groupExternalId": "group_vavikcxewkf5h3oxxxxxx"
        }
    ],
  ...
}

SAML console configuration example

On the SAML application configuration page, for Signing Algorithm, select SHA256 (only RSA-SHA256 is supported). Configure the following attribute mappings in the Attribute Statements section: organizationalUnits → ObjectToJsonString(user.organizationalUnits), organizationalUnitIds → ArrayJoin(ArrayMap(user.organizationalUnits, __item.organizationalUnitId), ","), groups → ObjectToJsonString(user.groups), groupIds → ArrayJoin(ArrayMap(user.groups, __item.groupId), ","), groupExternalIds → ArrayJoin(ArrayMap(user.groups, __item.groupExternalId), ","), grouldArray → SamlArray(ArrayMap(user.groups, __item.groupId)), customFields → ObjectToJsonString(user.customFields), and age → user.customFieldMap.age.fieldValue. In the SAML Response, these additional user fields can be returned to the application for parsing. For SSO initiator, select Support portal and application initiated, which supports initiating SSO by clicking on the IDaaS portal page and also supports active initiation from the application login.

Examples of parsed SAML extended values

Parsing the ObjectToJsonString(user.organizationalUnits) expression returns the following SAML response:

<saml2:Attribute Name="organizationalUnits" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    [{"organizationalUnitId":"ou_sdfadtaaxxxxxx","organizationalUnitName":"AD","primary":false},{"organizationalUnitId":"ou_werttxxxxxx","organizationalUnitName":"name_002","primary":true}]
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the ArrayJoin(ArrayMap(user.organizationalUnits, __item.organizationalUnitId), ",") expression returns the following SAML response:

<saml2:Attribute Name="organizationalUnitIds" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    ou_sdfadtaaxxxxxx,ou_werttxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the ObjectToJsonString(user.groups) expression returns the following SAML response:

<saml2:Attribute Name="groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    [{"groupId":"group_jp6al4sn4n4wjgjxxxxxx","groupName":"group1","groupExternalId":"group_jp6al4sn4n4wjgjxxxxxx"},{"groupId":"group_vavikcxewkf5h3oxxxxxx","groupName":"group2","groupExternalId":"group_vavikcxewkf5h3oxxxxxx"}]
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the ArrayJoin(ArrayMap(user.groups, __item.groupId), ",") expression returns the following SAML response:

<saml2:Attribute Name="groupIds" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    group_jp6al4sn4n4wjgjxxxxxx,group_vavikcxewkf5h3oxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the ArrayJoin(ArrayMap(user.groups, __item.groupExternalId), ",") expression returns the following SAML response:

<saml2:Attribute Name="groupExternalIds" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    group_jp6al4sn4n4wjgjxxxxxx,group_vavikcxewkf5h3oxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the SamlArray(ArrayMap(user.groups, __item.groupId)) expression returns the following SAML response:

<saml2:Attribute Name="grouIdArray" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:type="xsd:string">
    group_jp6al4sn4n4wjgjxxxxxx
  </saml2:AttributeValue>
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    group_vavikcxewkf5h3oxxxxxx
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the ObjectToJsonString(user.customFields) expression returns the following SAML response:

<saml2:Attribute Name="customFields" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:type="xsd:string">
    [{"fieldName":"place","fieldValue":"beijing"},{"fieldName":"age","fieldValue":"18"}]
  </saml2:AttributeValue>
</saml2:Attribute>

Parsing the user.customFieldMap.age.fieldValue expression returns the following SAML response:

<saml2:Attribute Name="age" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">
    18
  </saml2:AttributeValue>
</saml2:Attribute>