Create and Customize Attributes for a Custom Okta SAML Application Using Profile Mappings
Last Updated:
Overview
Customizing Secure Assertion Markup Language (SAML) attribute statements allows administrators to configure individual values for assigned users of an application. Configure these custom attributes by creating an attribute statement using the appuser profile and mapping the variables in the Okta application profile mappings.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Single Sign-On (SSO)
- Custom Secure Assertion Markup Language (SAML)
- Disabled System for Cross-domain Identity Management (SCIM) / Provisioning
Solution
How are custom SAML attributes created and mapped for individual users?
Define and Configure a Custom SAML Attribute Statement in Okta and configure the profile mappings to allow individual user attribute customization.
- Create an attribute statement for the custom SAML application. Instead of using
user.<attribute_name>, useappuser.<attribute_name>. For example, useappuser.titleinstead ofuser.title.
- Set up the profile mappings for the application.
- When adding the attribute, select the Data type required by the application for the SAML assertion.
- Enter an arbitrary value for the Display name.
- Enter a Variable name that exactly matches the
<attribute_name>specified in the attribute statement. For example, if usingappuser.title, the variable name must betitle.
NOTE: The administrator chooses the <attribute_name> arbitrarily; the only requirement is that it matches both the attribute statement and the profile mapping attribute name.
Once the administrator configures the application, the attribute appears in the user's application assignment and accepts edits. Administrators can override the profile mappings with a value that applies only to that specific user. If the configuration requires changes using Okta Expression Language, administrators must apply them through the application's profile mappings.
