# Identity Provider - IdP - User Attribute Mapping - XPath substring-after

**URL:** <https://forum.inductiveautomation.com/t/identity-provider-idp-user-attribute-mapping-xpath-substring-after/42245>\
**Category:** Ignition\
**Created:** [January 14, 2021, 4:02pm UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-user-attribute-mapping-xpath-substring-after/42245 "2021-01-14T16:02:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![calimero100582](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/calimero100582/32/18630_2.png) [@calimero100582](https://forum.inductiveautomation.com/u/calimero100582)\
**Post date:** [January 14, 2021, 4:02pm UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-user-attribute-mapping-xpath-substring-after/42245/1 "2021-01-14T16:02:34Z")

</div>

Hi

To manage roles, we created groups in our IdP starting with “Ignition-”

Is there a way in the IdP Attribute Mapping to use substring-after in the xpath so I can only manage Roles in ignition without “Ignition-”

Something like: substring-after(/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name=‘Roles’]/saml2:AttributeValue/text(), “Ignition-”)

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 14, 2021, 5:59pm UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-user-attribute-mapping-xpath-substring-after/42245/2 "2021-01-14T17:59:00Z")

</div>

I don’t think there is a clean way to do what you are asking for right now using just XPath or Ignition expressions. You may need to pass the collection of role strings to a jython script using the runScript expression function to do the filtering / manipulating of each role string in the collection (this only works in 8.1.1+), otherwise look to see if the IdP will support filtering out / transforming roles on its end based on which application the user is coming from (Ignition in this case).

---

<div class="post-metadata">

**Author:** ![calimero100582](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/calimero100582/32/18630_2.png) [@calimero100582](https://forum.inductiveautomation.com/u/calimero100582)\
**Post date:** [January 14, 2021, 7:04pm UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-user-attribute-mapping-xpath-substring-after/42245/3 "2021-01-14T19:04:09Z")

</div>

Thanks. Ignition and our IdP are brand new, and we found a solution on the IdP side