SAML Dynamic Attribute Mapping

RE: SAML Dynamic Attribute Mapping

Patricia — Mon, 25 Nov 2024 07:36:11 GMT

We don't have a middleware layer between the IDP and Appian, so the second option wouldn't be valid for us. I'll check with my team and the IDP to see if we can get two metadata files for the configuration, as Stefan mentioned, or apply the logic you mention in the IDP itself.
Thank you!

RE: SAML Dynamic Attribute Mapping

Patricia — Mon, 25 Nov 2024 07:26:32 GMT

We are trying to figure out if we can do this directly in Appian as it will be the easiest and quickest for us while we review this issue with the IDP.

RE: SAML Dynamic Attribute Mapping

Stefan Helzle — Mon, 25 Nov 2024 07:20:50 GMT

Sure, you will need two of these.

RE: SAML Dynamic Attribute Mapping

Patricia — Mon, 25 Nov 2024 07:13:30 GMT

I have tried this already but Appian doesn't allow to use the same Idp metadata file in two different confgurations. I get this error "Another identity provider already exists with the same entity ID provided in this metadata file. Entity IDs must be unique."

RE: SAML Dynamic Attribute Mapping

naveenkumar11800 — Sat, 23 Nov 2024 14:53:05 GMT

Patricia and Stefan Helzle

Stefan’s suggestion about creating separate configurations is a great starting point! If that’s not feasible, here are a couple of other ideas:

Rule-Based Mapping at the IdP:
If your IdP supports conditional logic, you could configure it to check if the email claim is empty. If so, fallback to using the name claim for the email attribute before sending it to Appian.
Middleware Preprocessing:
If you have a middleware layer between the IdP and Appian, it could inspect the SAML assertion and adjust the claims dynamically (e.g., map name to email when the email claim is empty).

RE: SAML Dynamic Attribute Mapping

Stefan Helzle — Fri, 22 Nov 2024 14:32:14 GMT

Did you consider to create two separate configurations to the same IDP but with different mappings? When putting the two user groups into different Appian groups you can make them automatically use their respective login.

RE: SAML Dynamic Attribute Mapping

David Jimenez — Fri, 22 Nov 2024 12:00:37 GMT

Could'nt be possible map that value in another way? I mean, apply that logic on the client side.,