Adding SAML Attribute Statements to SAML Connections

In SAML transactions, identity providers make an assertion about an authenticated user's identity, encrypt and sign the assertion, and pass that data to a service provider. The service provider receives the assertion, validates and decrypts it, and makes an access control decision, granting or denying access to services as is appropriate.

One component of an assertion is the attribute statement. Attribute statements are sent from identity providers to service providers to convey information about the subject of the assertion. The SAML specification allows for these attributes to be any type of agreed upon information. Thus if you have a partnership with a service provider requiring a specific attribute be sent (such as a Person's EmployeeID), you must add a SAML Attribute Statement with the required SAML attribute in your assertion.

In this topic we demonstrate how to add an attribute statement to an SSO connection by creating a new attribute statement for the connection, as well as a new attribute for the attribute statement.

To add a SAML Attribute Statement to a SAML SSO Connection

  1. From the Navigation Sidebar, navigate to the SAML SSO Management page by expanding Admin > SSO Connections and clicking SAML.
  2. Search for the SAML Connection to which you want to add the SAML attribute statement, click the drop-down arrow beside the record for that connection and then click Edit.
  3. This opens the Edit page for the SSO Connection. From this page you can edit the properties of the connection.

  4. From the Connection Details page that appears, click the Attributes tab and do the following:
    1. Tick Create a New SAML Attribute Statement and then tick Create a SAML Attribute.
    2. This opens the SAML Attribute dialog, where you enter the appropriate information for the attribute.

      Of the dialog fields appearing here, the following have the most significance:

      • Name - This is the name you are giving to the attribute. This field is required.
      • Display Name - This is the name of the attribute that appears to users on EmpowerID User Interfaces.
      • Mapped Attribute - Specifies whether the selected attribute is mapped to the value of an EmpowerID Person or account property. When this is the case, the attribute value stores the mapping formatted as {ComponentName.PropertyName} where ComponentName is either Person, PersonPrincipal (a pared down version of Person), Account or AccountPrincipal (a pared down version of Account) and PropertyName is the mapped property on the component, such as EmployeeID.
      • Attribute Value - This specifies the value of the attribute being passed to the service provider. For example, if you are passing an attribute that is mapped to the EmployeeID of an EmpowerID Person, the value of this field would be {Person.EmployeeID}.
      • Format - This is the format of the attribute as specified by the service provider. If the service provider has not specified a format then you select Unspecified.
    3. Fill in the fields as is appropriate for your situation and then click Add to close the SAML Attribute dialog.
    4. Back in the main page, click Save.