Does SAML plugin support custom attributes ?

[10年前 に Ashish Gupta によって更新されました。]

I have configured 2 Liferay instances, one as IdP and another as SP. I am able to successfully test sso between the 2. Now I'm trying to send user custom fields from IdP to SP and while I'm able to send the custom fields from IdP (I verified the sent SAML) These custom fields are not being processed on SP side. Below are the relevant portal-ext properties.

IdP :
saml.idp.metadata.attribute.names[liferaysamlspdemo]=screenName,firstName,lastName,emailAddress,expando:ucstxt,expando:crcinfo,comments,uuid

SP :
saml.sp.user.attribute.mappings=screenName=screenName\nemailAddress=emailAddress\nfirstName=firstName\nlastName=lastName\nexpando:ucstxt=ucstxt\nexpando:crcinfo=crcinfo\ncomments=comments

Has anyone else tried and able to successfully map custom attributes on SP side ?
Is it even possible with the current version of the plugin?

[10年前 に Mika Koivisto によって更新されました。]

For SP the expando attribute name actually comes without expando: now this might cause conflicts with attribute names so later versions we've added namespacing to all attribute names while also retaining ability to use non namespaced attributes for backwards compatibility.

[10年前 に Ash Gupta によって更新されました。]

Hi Mika,
So does that mean i should remove references to expando: from my sp attributes mapping, so it should be like below ?

I also noticed that the "comments" field (not an expando) is also not flowing through to SP. That may be a bug/missing behavior ?

SP :
saml.sp.user.attribute.mappings=screenName=screenName\nemailAddress=emailAddress\nfirstName=firstName\nlastName=lastName\nucstxt=ucstxt\ncrcinfo=crcinfo\ncomments=comments

Thanks the looking into this.

Ash

[10年前 に Ash Gupta によって更新されました。]

Mika Koivisto:

For SP the expando attribute name actually comes without expando: now this might cause conflicts with attribute names so later versions we've added namespacing to all attribute names while also retaining ability to use non namespaced attributes for backwards compatibility.

Hi Mika,

Changed my sp attributes mapping to below, removing expando: with no change in behavior, custom user attributes are still not getting in on SP side.

saml.sp.user.attribute.mappings=screenName=screenName\nemailAddress=emailAddress\nfirstName=firstName\nlastName=lastName\nucstxt=ucstxt\ncrcinfo=crcinfo\ncomments=comments


Ash

[10年前 に Mika Koivisto によって更新されました。]

Ah sorry didn't read carefully enough how you were mapping. The SP attribute mapping only supports following attributes to be mapped: screenName, emailAddress, firstName, lastName, uuid. Mappings to any other attributes will simply go ignored. Expanded support for mapping is in the roadmap.

[10年前 に Ash Gupta によって更新されました。]

Hi Mika,
Thanks for the confirmation. Is there a liferay IDE support project for the saml plugin that I can download and extend to support custom attribute?

regards
Ash

[9年前 に Montoo Garg によって更新されました。]

Hi Mika,

i am looking for mapping additional attributes apart from screenName, emailAddress, firstName, lastName, uuid. Could you please check if this is already implemented in the current version of SAML Plugin?

Thanks,
Montoo Garg

[8年前 に Amarendar Pashya によって更新されました。]

Hi Mika,

I am looking for a similar feature too. We have a set of roles being sent from the IDP through SAML along with other details. We want to assign those roles to the user when the user login for the first time to the portal.

Thanks
Amar

[8年前 に Thierry Dagnino によって更新されました。]

Hello Mika and everyone else,

did anyone get a reply on this. We also need to use other custom attributes . How do we do it ?
We are on liferay 6.1.2.
We need to send custom data through the SAML attributes.

Thank you.

[6年前 に Naresh Reddy Kallamadi によって更新されました。]

Hi Amarendar Pashya,

I too have similar scenario where I am trying to assign role to user which are from IDP. Did you have any solution for this?

Thanks,
Naresh Kallamadi.

[8年前 に Thierry Dagnino によって更新されました。]

Hello,

I've set saml.idp.metadata.attribute.names=expando:customfield1,emailAddress and get only the customfiel1 in the saml attributes sent over by IDP.

I always only get the first attribute name in the list.

Is there a special way to separate the attribute names in the file ?

Thanks.

[8年前 に Anderson Marques によって更新されました。]

Hello everyone,

Please @Mika or someone could help with custom attributes?
Is possible do that on the current SAML plugin version. Could you help me please?

Thanks in advance,
Anderson

[7年前 に Felix Gonzalez de Santos によって更新されました。]

Hello all,
We need the same functionality for roles, anyone has more info about that?

Regards