SAML 2 Direct Mapped User Attributes

Hi,

What is the path syntax for direct mapping SAML 2 user attributes in Ignition? I do not see an example in the user manual found at

https://docs.inductiveautomation.com/display/DOC81/User+Attribute+Mapping

How would I direct map the First Name attribute to the ‘givenname’ SAML response below? If multiple roles are assigned by the IdP, how are they mapped to Ignition?

I tried to follow the path syntax for the ID attribute, but I couldn’t figure out the the connection between the path listed and the SAML response.

Tagging Joel here as he seems to have the solution to all SAML question @jspecht

There is a section in the user manual page that you referenced titled Expression Mapping with sub-section titled Attribute Path which mentions:

If the attribute source is an XML document (as is the case with SAML IdPs), then an XPath 1.0 expression may be used to reference the target attribute. See the Multi-Valued Object Example further down.

If you then scroll down to the Multi-Valued Object Example, you can see a sample SAML XML Response and a corresponding XPath expression referencing a multi-valued attribute such as roles.

The same principle applies for Direct User Attribute Mapping - except you just put the XPath expression itself directly as the value in the Direct User Attribute Mapping setting.

See if you can come up with the appropriate XPath expression for your use case given the above information, and if you are still having trouble, DM me your SAML XML Response and which attributes you are trying to map to and I’ll see if I can give you some better guidance.