Process isMemberOf in SAML response

This topic has 1 reply, 2 voices, and was last updated 2 weeks, 3 days ago by Jatinder Singh.

  • Author
    Posts
  • #28531
     gleyfer
    Participant

    I have a remote SAML SP configured in OpenAM where, in the attribute mapper, I am passing the isMemberOf virtual attribute from OpenDJ to provide the group membership info in the SAML response. The application uses this to map the groups to corresponding RBAC groups.

    As per: https://forum.forgerock.com/topic/modifying-saml-response/

    the issue is that isMemberOf provides a list of LDAP DN’s instead of just the group names. E.g.,

                <saml:Attribute Name="Profile">
                    <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">cn=app_admin,ou=groups,dc=openam,dc=forgerock,dc=org</saml:AttributeValue>
                    <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">cn=app_readonly,ou=groups,dc=openam,dc=forgerock,dc=org</saml:AttributeValue>
                </saml:Attribute>

    I would like to pass in just the group names. E.g., app_admin, app_readonly instead of the full DN because the app cannot handle the DN format.

    The cleanest solution from the linked forum post was to create a user-defined virtual attribute in OpenDJ, but the example provided only assigned one static value/string to anything that matched the filter. In my case, different users will be in different groups corresponding to different RBAC permissions in the app and I cannot use a single static value assignment.

    Are my only options either creating a custom attribute mapper class and processing the isMemberOf there or creating a custom virtual attribute provider class?

    https://backstage.forgerock.com/knowledge/kb/article/a67576704
    https://backstage.forgerock.com/docs/opendj/2.6/configref/user-defined-virtual-attribute.html#java-class

    Just seems like a lot of work to get a simple list of groups and wanted to check here first.

    #28551
     Jatinder Singh
    Participant

    Using a custom attribute mapper is the most flexible way to implement your requirement.

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.

©2021 ForgeRock - we provide an identity and access platform to secure every online relationship for the enterprise market, educational sector and even entire countries. Click to view our privacy policy and terms of use.

Log in with your credentials

Forgot your details?