# Assign SAML response roles to Security User Roles **URL:** \ **Category:** Ignition\ **Tags:** ignition83\ **Created:** [March 17, 2026, 9:18pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534 "2026-03-17T21:18:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 17, 2026, 9:18pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/1 "2026-03-17T21:18:34Z")
Hi, I was able to assign Following response is recieved in Groups: ```python 18029425,10790416 ``` The security level grants are weird, as they don’t have Administrator or User, rather the string itself. Any idea how I can assign Administrator to 10790416 and User to the other one? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/9/0979a397c4f55b0c1a0f62d9c7e4215aefa415a3.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/optimized/3X/4/e/4e4cb9ad27ab5586c46cff00f85d4ad19bc5bd22_2_690x32.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/3/b31456b498bb524293c8055b5829d272389d80cf.png) ---
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 17, 2026, 9:18pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/2 "2026-03-17T21:18:56Z")
Loosely related to [SAML Security grants not visible - #2 by gmatano](https://forum.inductiveautomation.com/t/saml-security-grants-not-visible/114520/2) ---
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 17, 2026, 11:39pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/3 "2026-03-17T23:39:00Z")
I’m reading about [runScript](https://docs.inductiveautomation.com/docs/8.3/appendix/expression-functions/advanced/runScript) too, but wanted to make sure: Can I make a runScript and paste it directly into the User Attributed Mapping\> “Roles” \> Expression textbox? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 17, 2026, 11:41pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/4 "2026-03-17T23:41:55Z")
I'm pretty sure you want the special `containsAny` expression here: > **[containsAny | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/appendix/expression-functions/identity-provider/containsAny)** > > This function checks to see if any of the listed elements are present in the collection object. The function requires at least two arguments, a collection and an element. ---
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 18, 2026, 12:07am UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/5 "2026-03-18T00:07:27Z")
Can you give me a clearer way of doing this? So: in Administrator security expression/RULE, should I type in: ContainsAny(‘10790416’) ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 18, 2026, 2:48pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/6 "2026-03-18T14:48:53Z")
I think that in theory it would be something like this: ```python containsAny( {multi-attribute-source:authnResponse:/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="Groups"]/saml2:AttributeValue/text()}, 10790416 ) ``` Based on combining these two pages: > **[Special Function Reference​ - Security Level Rules | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/identity-provider-authentication-strategy/security-level-rules#special-function-reference)** > > When a user accesses a project, they can fall into one or more of many Security Levels that you can set up. The Security Level Rules determine if the user has that Security Level or not. The rules come in the form of expressions that can access any... > **[Multi-Valued Object Example​ - User Attribute Mapping | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/identity-provider-authentication-strategy/configuring-identity-providers/user-attribute-mapping#multi-valued-object-example)** > > The User Attribute Mapping page allows you to map information in the Identity Providers (IdP) response document to easily understandable properties. These properties are then made available as Session Properties in the Perspective Session. To work,... But that may not work, because I think the fact that your IdP is returning the two roles as one string will make things harder. Normally you'd expect an actual multi-value collection in the XML/JSON response from the identity provider, but you're just getting a string that happens to contain a comma. I expect you can still get around it _somehow_, possibly requiring `runScript`, but this is well outside of my area of expertise. ---
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 18, 2026, 7:16pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/7 "2026-03-18T19:16:56Z")
I changed it now on the IDP side, so it shows up like this: ```python 18029425 10790416 ``` ---
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 18, 2026, 7:21pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/8 "2026-03-18T19:21:31Z")
Now I’m getting two separate entries here: But Administrator and User is still not visible: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/d/1d24b8baa051b70ab694a05db5c1d8dc50be732b.png) I included these under Security Level Rules for Administrator and User: containsAny( {multi-attribute-source:authnResponse:/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="Groups"]/saml2:AttributeValue/text()}, 10790416 ) Mapped roles look like this: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/e/5e44ff33904eca16199e6964d8afa9aef7894776.png) ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [March 18, 2026, 8:18pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/9 "2026-03-18T20:18:35Z")
You cannot configure how Role-based Security Levels are granted through User Grants or Security Level Rules. Role-based Security Levels are granted based on the roles mapped onto the User. Instead, you’ll need to properly set up the User Attribute Mapping for the Roles attribute. Here’s a post for how someone else solved this using the runScript expression function inside an expression user attribute mapping: [Easiest way to map AD roles to the default security levels - #2 by colethorton](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327/2) You might upvote this idea linked from the above post: [Active Directory Role Mapping | Voters | Inductive Automation](https://ideas.inductiveautomation.com/ignition-features-and-ideas/p/active-directory-role-mapping) If your role map is simple enough, you might get away with using the case expression function instead of runScript: [case | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.3/appendix/expression-functions/logic/case) ---
**Author:** ![TimeLordship](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/timelordship/32/50264_2.png) [@TimeLordship](https://forum.inductiveautomation.com/u/TimeLordship)\ **Post date:** [March 18, 2026, 11:37pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/10 "2026-03-18T23:37:16Z")
Great! I was able to finally get it via the Roles. My runScript: runScript("0\nimport java.util.ArrayList as ArrayList\nroles = ArrayList()\ngroups = '" + toString({multi-attribute-source:authnResponse://saml:Attribute[@Name='Groups']/saml:AttributeValue/text()}) + "'\nif '10790416' in groups:\n\troles.add('Administrator')\nif '18029425' in groups:\n\troles.add('User')\n\_\_RESULT = roles")