# MS Azure SAML Role Mapping

**URL:** <https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230>\
**Category:** General Discussion\
**Created:** [August 24, 2021, 3:43pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230 "2021-08-24T15:43:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![adam.todorski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adam.todorski/32/19388_2.png) [@adam.todorski](https://forum.inductiveautomation.com/u/adam.todorski)\
**Post date:** [August 24, 2021, 3:43pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/1 "2021-08-24T15:43:22Z")

</div>

Hi All

I’m trying to integrate Ignition with MS Azure’s SAML interface and generally have it working but I cannot get the roles to map over. The SAML tokens come back with the group info formatted like so:

```auto
<samlp:Response...
    <Assertion ...
        <AttributeStatement>
            ...
            <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">
                <AttributeValue>2c812e15-57ad-4463-bcbf-d8f3edcce491</AttributeValue>
            </Attribute>

```

I came up with the following expression for the role mapping expression:

```auto
{mult-attribute-source:authnResponse:/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"]/saml2:AttributeValue/text()}

```

But it doesn’t work, I get the following error:

Invalid reference ‘mult-attribute-source:authnResponse:/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name=“[http://schemas.microsoft.com/ws/2008/06/identity/claims/groups](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups)”]/saml2:AttributeValue/text()’ in expression tag ‘null’

I may be missing something obvious, but I can’t figure out what the issue is. Does something jump out at anyone else?

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [August 24, 2021, 6:24pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/2 "2021-08-24T18:24:27Z")

</div>

Looks like a simple typo:

Change `{mult-attribute-source:` to `{multi-attribute-source:` (the `i` at the end of `multi`)

---

<div class="post-metadata">

**Author:** ![adam.todorski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adam.todorski/32/19388_2.png) [@adam.todorski](https://forum.inductiveautomation.com/u/adam.todorski)\
**Post date:** [August 24, 2021, 6:51pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/3 "2021-08-24T18:51:56Z")

</div>

Thanks! This worked, note that the documentation has it without the “i”:

[https://docs.inductiveautomation.com/display/DOC81/User+Attribute+Mapping](https://docs.inductiveautomation.com/display/DOC81/User+Attribute+Mapping)

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [August 24, 2021, 7:12pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/4 "2021-08-24T19:12:25Z")

</div>

Glad you got it working. I suspected that the typo might be in the docs, and a simple copy-paste error was at play. I notified someone who manages those pages and they will be fixing the typo soon.

---

<div class="post-metadata">

**Author:** ![jgooding](https://avatars.discourse-cdn.com/v4/letter/j/a88e4f/32.png) [@jgooding](https://forum.inductiveautomation.com/u/jgooding)\
**Post date:** [October 15, 2021, 12:14am UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/5 "2021-10-15T00:14:45Z")

</div>

I apologize for taking over a thread, but how does all of those 2 i.e saml2p work with this response. Why is it not samlp:response for the first level to the path? I can not get mine to work and I have the same format as the original poster. The samples online had saml2p as the reponse in the sample file.

Thansk.

---

<div class="post-metadata">

**Author:** ![jgooding](https://avatars.discourse-cdn.com/v4/letter/j/a88e4f/32.png) [@jgooding](https://forum.inductiveautomation.com/u/jgooding)\
**Post date:** [October 19, 2021, 10:21pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/6 "2021-10-19T22:21:01Z")

</div>

After a call with Tech support for some reason it is not SAML as the files shows, you have to use SAML2 and SAML2P for all of your calls. This is really confusing and needs to be documented. I wish this was better documented.

---

<div class="post-metadata">

**Author:** ![ted.garrison](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ted.garrison/32/11732_2.png) [@ted.garrison](https://forum.inductiveautomation.com/u/ted.garrison)\
**Post date:** [September 18, 2023, 8:33pm UTC](https://forum.inductiveautomation.com/t/ms-azure-saml-role-mapping/50230/7 "2023-09-18T20:33:58Z")

</div>

Agree on this. The format that you have to use in your call doesn't match the format of the actual response doc. And yet some of the online Xpath tools have no problem using the format from the response doc. Confusing as can be. Thankfully I stumbled on this thread.