00u4g3z04rrwGkVWa2p71.562550329560332E12 (Customer) asked a question.
We're setting up an In-Bound SAML IdP that is fetch identities with givenname, surname, emailaddress from an external IDP. I have configured these as custom attributes in the In-Bound IdP and mapped to the corresponding Okta User profile attributes (firstName and lastName).
Yet when I come back to the In-Bound SAML attribute and mapping definition I find the unwanted custom attributes firstName, lastName, email, and mobile have been added and mapped as well. Also the first three of these are required which causes a problem as they are not in the SAML coming coming the external IDP.
Why is Okta adding these to the custom attributes of the In-Bound SAML profile and how do I stop it doing this?
Here's what I am seeing in the metadata downloaded from the In-Bound SAML.
<md:AttributeConsumingService index="0">
<!-- Good - These first three are the ones the exteral IdP is suppling to us in the SAML ResponseSecurityToken -->
<md:RequestedAttribute FriendlyName="Surname" Name="surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<md:RequestedAttribute FriendlyName="Given Name" Name="givenname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<md:RequestedAttribute FriendlyName="Email address" Name="emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<!-- Bad - The ones below are not available from the external IdP and can not be provide.
We do not want to require the external IdP to provide them.
Yet even if I explicitly delete these custom attributes from the In-Bound SAML profile configuration they keep getting added back. Removing from this XML makes no difference as the In-Bound SAML still requires them.
--->
<md:RequestedAttribute FriendlyName="First Name" Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<md:RequestedAttribute FriendlyName="Last Name" Name="lastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<md:RequestedAttribute FriendlyName="Email" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true"/>
<md:RequestedAttribute FriendlyName="Mobile Phone" Name="mobilePhone" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="false"/>
</md:AttributeConsumingService>
How do I stop the Okta In-bound SAML automatically adding these unwanted custom attributes?