SAML field mapping, NameID mapping, SAML assertion attributes, IDaaS account attribute synchronization - Identity as a Service

Basic concepts

Field mapping keeps IDaaS and external accounts consistent at two levels:

Account level: Binds account status. When a user is deleted from an integrated application, the corresponding IDaaS account is also deleted.
Field level: Maps individual fields between bound accounts. For example, you can map a user's corporate email to the IDaaS display name. When the email changes, the display name updates automatically.

Note

Delete a binding only after the corresponding IDaaS account, organization, or group is deleted. Organizations support binding and field mapping but not mapping identifiers.

Access the field mapping page

Access the Field Mapping configuration page:

During creation: Configure field mapping when creating a IdPs.
During modification: On the IdPs-> Inbound page, click Modify Settings. In the dialog box, go to the Field Mapping tab.

Configure field mapping

With accounts bound, field mapping keeps attributes consistent between the identity provider and IDaaS. For example, map a user's corporate email to the IDaaS display name — the display name updates when the email changes.

Note

Available mapping identifiers vary by identity provider. Set one based on your business needs, or leave it unset.

Mapping rules

IDaaS supports two field mapping methods:

Mapping method

Description

Select field

Use a sync source field value as the target field value. For SAML IdP, only the username attribute is available for mapping and is generated by default.

Expression

Define a custom value for the target field using an expression. Common usages:

Use fields outside the predefined list: IDaaS retrieves AttributeStatement data from the SAML configuration and maps it to the idpUser.attributes object. Configure a Configure Field Mapping on the Extended Field page. For example, to retrieve email from the SAML XML:
```
<saml2:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
    <saml2:AttributeValue>te**@test.com</saml2:AttributeValue>
</saml2:Attribute>
```
On the Configure Field Mapping page, for the email (user.email) row, set Mapping Rule to Expression, and enter idpUser.attributes.email.value in the Field Value field. For multi-value fields (multiple AttributeValues in SAML XML), enter idpUser.attributes.email.values in the Field Value field.
Extract the email prefix as the field value:
- Use the email prefix: SubstringBefore(idpUser.attributes.email.value,"@")
- Use the AD UPN prefix: SubstringBefore(idpUser.attributes.userPrincipalName.value,"@")
Use a fixed value: Trim("myString")

Note

The field format in IDaaS expressions is: for the inbound direction, "idp" + "User/OrganizationOU" + "." + "field name in the identity provider"; for the outbound direction, "idp" + "User/OrganizationOU" + "." + "field name in IDaaS". For example, idpUser.attributes.email.value. For more expression samples and syntax details, see Account field expressions.

To remove a mapping, click Remove. The rule changes to "Do not map" and the field is skipped during synchronization.