Loading...

Mapping SAML Attributes

Table of Contents

Available Attributes

Procedure

Examples

You can map attributes in the identity provider (IdP) response to user attributes used in the Commvault software. For example, by default, a user email address is expected in the NameID element in the IdP response. If your IdP sends the user email address in an attribute instead of in the NameID element, you can map that attribute so that the value of the attribute is used for the user email address.

Available Attributes

You can map IdP response attributes to the user attributes in the following table. Your mappings take precedence over default sources.

User Attribute

Details

user name

The mapping for the user name attribute is used to validate the user when they log on. The default source for the user name attribute is the NameID element.

<Subject>
  <NameID>jknight</NameID>
  ...
</Subject>

user groups

Applies to: AD FS and Okta identity providers

The mapping for the user groups attribute is used to associate or disassociate the user with domain groups (external groups) that were added to the CommCell environment.

email

The mapping for the email attribute is used to validate the user when they log on. The default source for the email attribute is the NameID element.

<Subject>
  <NameID>jknight@mycompany.com</NameID>
  ...
</Subject>

user GUID

If the Auto create user option is selected, the mapping for the user GUID attribute is used as the user GUID. If the Auto create user option is selected and a mapping is not provided, the user GUID is a system-generated value.

SID

Applies to: Active Directory identity providers

The mappings for the SID attribute and the group SID attribute are used to facilitate the ACL (Access Control List) browse for agents such as the Windows File System Agent and the SharePoint Server Agent.

Group SID

company name

Applies to: Multi-tenant CommCell environments

The mapping for the company name attribute is used to configure SAML authentication at the CommCell level. The SAML authentication applies to all companies in the CommCell environment. For instructions about configuring SAML authentication at the CommCell level, see Configuring SAML Authentication for All Tenants.

Procedure

  1. From the navigation pane, go to Security > Identity servers.

    The Identity servers page appears.

  2. In the Application name column, click the application name.

    The application details page appears.

  3. Under Attribute mappings, click Edit.

    The Edit attributes dialog box appears.

  4. Click Add mappings.
  5. In the SAML attributes box, enter the attribute from the IdP response.

    For example, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

  6. In the User attributes list, click the user attribute that the IdP response attribute maps to.

    For example, if the IdP response attribute is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, click Email.

  7. To add additional mappings, click Add mappings.
  8. Click Save.

Examples

The following samples are mappings and the results of the mappings:

SAML Attribute

User Attribute

Attribute statement

Result

http://schemas.microsoft.com/2012/12/certificatecontext/field/subject

email

<AttributeStatement>
  <Attribute Name="http://schemas.microsoft.com/2012/12/certificatecontext/field/subject">
    <AttributeValue>jknight@mycompany.com</AttributeValue>
  </Attribute>
</AttributeStatement>

The value jknight is used to validate the user.

http://schemas.xmlsoap.org/claims/Group

user groups

<Attribute Name="http://schemas.xmlsoap.org/claims/Group">
  <AttributeValue>Domain Users</AttributeValue>
</Attribute>

The user is associated with the Domain Users group.

Last modified: 10/11/2019 6:35:58 PM