SAML field mapping,NameID mapping,SAML assertion attributes,IDaaS account attribute synchronization - Identity as a Service

When you log on through a SAML IdP, IDaaS uses AttributeStatement data in the SAML assertion to automatically synchronize and update IDaaS account fields.

Key concepts

With field mapping, you can keep IDaaS accounts consistent with external accounts at the following two levels:

Account level: Account binding keeps account status consistent. When an integrated application deletes a user, the corresponding IDaaS account is also deleted.
Field level: Building on account binding, field mapping keeps account information consistent. For example, you can use the corporate email address of an integrated application user as the display name of the IDaaS account. When the email address changes, the display name of the IDaaS account is also updated.

Note

You can delete a binding only after you delete the IDaaS account, organization, or group. Organizations also support binding and field mapping, but do not yet support mapping identifiers.

Access the field mapping page

You can access the Field Mapping configuration page in either of the following ways:

During creation: Configure field mapping directly while creating IdPs.
During modification: On the IdPs > Inbound page, click Modify Settings. In the dialog box, switch to the Field Mapping module.

Configure field mapping

Building on account binding, field mapping keeps account information consistent. For example, you can use the corporate email address of a user in the integrated identity provider application as the display name of the IDaaS account. When the email address changes, the display name of the IDaaS account is also updated.

Note

Different identity providers support different fields as mapping identifiers. Based on your business needs, you can set one of the fields as the mapping identifier, leave it unset, or cancel an existing setting.

Mapping rules

IDaaS supports the following two field mapping methods:

Mapping method

Description

Select field

Select a field from the synchronization source and use its value directly as the value of the corresponding field in the synchronization target. At the field level, a SAML IdP supports only username attribute mapping, which is generated by default.

Expression

Use an expression to define a custom value and use it as the value of the corresponding field in the synchronization target. Expressions flexibly support a wide range of use cases. Common uses include:

Use a field outside the field scope: IDaaS can obtain AttributeStatement data from the SAML of the integrated application and map the data to the idpUser.attributes object. On the Configure Field Mapping page, configure Extended Field to obtain the required information. For example, to obtain email from the SAML XML configured in the integrated application:
```
<saml2:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
    <saml2:AttributeValue>te**@test.com</saml2:AttributeValue>
</saml2:Attribute>
```
On the Configure Field Mapping page, in the email (user.email) row, set Mapping Rule to Expression, and in Field Value enter idpUser.attributes.email.value. If email has multiple AttributeValue entries in the SAML XML (that is, a multi-value field), in Field Value enter idpUser.attributes.email.values.
Extract the email prefix as the field value:
- Use the email prefix: SubstringBefore(idpUser.attributes.email.value,"@")
- Use the AD UPN prefix: SubstringBefore(idpUser.attributes.userPrincipalName.value,"@")
Use a fixed value: Trim("myString")

Note

The field format in IDaaS expressions is as follows: for the inbound direction, "idp"+"User/OrganizationOU"+"."+"the field name in the identity provider"; for the outbound direction, "idp"+"User/OrganizationOU"+"."+"the field name in IDaaS". For example, idpUser.attributes.email.value. For more expression examples and syntax, see Advanced account field expressions.

For a field that you do not want to map, click Remove. The mapping rule then changes to no mapping, and the field data is not processed during synchronization.