# Ignition 8.0.2, May 7th Identity Provider - User Mapping Attributes - Roles property does not get mapped to IdP Response value

**URL:** <https://forum.inductiveautomation.com/t/ignition-8-0-2-may-7th-identity-provider-user-mapping-attributes-roles-property-does-not-get-mapped-to-idp-response-value/24852>\
**Category:** Ignition\
**Created:** [May 9, 2019, 8:31pm UTC](https://forum.inductiveautomation.com/t/ignition-8-0-2-may-7th-identity-provider-user-mapping-attributes-roles-property-does-not-get-mapped-to-idp-response-value/24852 "2019-05-09T20:31:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![will](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/will/32/5037_2.png) [@will](https://forum.inductiveautomation.com/u/will)\
**Post date:** [May 9, 2019, 8:31pm UTC](https://forum.inductiveautomation.com/t/ignition-8-0-2-may-7th-identity-provider-user-mapping-attributes-roles-property-does-not-get-mapped-to-idp-response-value/24852/1 "2019-05-09T20:31:43Z")

</div>

I am using an external Open ID Connect 1.0 identity provider and attempting to map user roles into the Mapped User Attributes.

Using test login; my IdP response data from my provider looks like:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/b/bf31114c1eee423266929ff8811fde021cb2e8d4.png)

The appropriate roles list is populated in the IdP response @ property “[http://tt.com](http://tt.com)”

My mapped user attributes test login result looks like:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/2/2394a029613ba5bd702b6dc7ed4a3464d0b8a75d.png)

I have tried a few different combinations of both direct and expression-based user attribute mappings. The latest being:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/b/b6d364e938f93f7bb71f64705ed22437c5f1cb18.png)

I thought maybe the issue was with forward slashes // in the property path, so I also tried surrounding with double quotes with no success. The Roles property is always blank. All of the other properties I have been able to map with direct mappings, although those properties differ in that they expect strings instead of Lists I believe.

Has anyone else succeeded in something like this / had any experience? Thanks!

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [May 10, 2019, 4:58pm UTC](https://forum.inductiveautomation.com/t/ignition-8-0-2-may-7th-identity-provider-user-mapping-attributes-roles-property-does-not-get-mapped-to-idp-response-value/24852/2 "2019-05-10T16:58:17Z")

</div>

Hi @will -

It is most likely the characters in the property with key `http://tt.com` that is causing the problem. You can confirm by setting `gateway.UserAttributeMapper` logger to debug and trying login again. You should see an exception in the logs.

Try using a direct mapper of `["http://tt.com"]` instead. That should give you what you want.

---

<div class="post-metadata">

**Author:** ![will](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/will/32/5037_2.png) [@will](https://forum.inductiveautomation.com/u/will)\
**Post date:** [May 10, 2019, 5:19pm UTC](https://forum.inductiveautomation.com/t/ignition-8-0-2-may-7th-identity-provider-user-mapping-attributes-roles-property-does-not-get-mapped-to-idp-response-value/24852/3 "2019-05-10T17:19:37Z")

</div>

Direct Mapper fixed it. Thank you very much!