Adding SAML Applications (Attribute Mapping (User Attribute))
This page describes how to specify user attributes to be included in Attribute Information (AttributeValue) in SAML responses.
| Option | Description | |
|---|---|---|
| SAML attribute name | Enter the attribute name. | |
| Mapped user attribute | Specify a user attribute. | |
| User attribute filter | Narrows down user attribute values to be sent when a user attribute has multiple values. | |
| Use the primary value | Uses the attribute specified as a primary value. If no attributes configured as primary values exist for the user, an empty string will be sent to the SP. |
|
| Use values that match the type | Uses the type to select an attribute. The attribute that exactly matches the input type is selected. If no attributes that exactly match the input type are set to the user, an empty string will be sent to the SP. |
|
The user attributes that can be specified are as follows:
| User attribute |
|---|
| ID |
| UUID |
| Notification email address |
| Application-linking ID |
| External ID |
| Display name |
| Last name |
| First name |
| Department |
| Position |
| Language |
| Phone numbers |
| IMs |
| Entitlements |
| Authentication method (AMR) |
Authentication Method (AMR)
When Authentication Method References (AMR) is configured as a mapped user attribute, the authentication method used during login is sent. Unlike other user attributes, which contain predefined values, the AMR value is determined based on the authentication method used at the time of login. Therefore, even for the same user, the value to be sent may differ depending on the authentication method used.
The values to be sent for Authentication Method References (AMR) are listed below.
| Authentication Method Used for Login | Sent Value |
|---|---|
| FIDO2 | pop |
| Password | pwd |
| Upstream ID Provider | idp |
| Email one-time password | |
| Device certificate | cert |
| SmartKey (slide authentication) | slide |
| SmartKey (one-time password authentication) | otp |
[ Reference ]
- If multiple authentication methods are used for login, "mfa" is added in addition to the values corresponding to each authentication method.
- Multiple values are combined into a single attribute value, separated by semicolons (;), for example, pwd;email;mfa.