BrianP.27007 (Customer) asked a question.
We have an integration with Ping, which is passing over the "memberOf" user attribute. We've created a custom "memberOf" string array attribute on our end, which is successfully storing the group information passed from Ping.
We're also passing the same "memberOf" attribute to a third party using Okta. Everything is fine where a single group is passed to the third party, but when there are multiple groups passed to the third party the SAML isn't formatting them properly. They are showing as comma separated values in a single string array attribute.
What would be the best way to send SAML to the third party which matches SAML from Ping to Okta?
Here is a snippet from the Ping to Okta SAML, showing multiple "memberOf" attribute values:
SAML from Ping to Okta
<saml:Attribute Name="memberOf" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Admin</saml:AttributeValue>
<saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Editor</saml:AttributeValue>
<saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Viewer</saml:AttributeValue>
</saml:Attribute>
SAML Okta to Third Party
<saml2:Attribute Name="memberOf" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Admin,Editor,Viewer</saml2:AttributeValue>
</saml2:Attribute>
Hi Brian,
I hope you are great! I am Mario helping here. Looks you are needing the feature that enable the tenant to support Array attributes.
Kindly get in contact with your Account Executive so he can check all the entitlement is OK to enable this attribute on your tenant. Once AE check this information and the attribute is enable, you will be able to see the SAML group information as different values and not only one.
I hope this answer your query.
Thanks for your answer Mario. We found out through some web searching shortly after my post here that we needed to contact Okta support and hav them enable the global feature flag named SAML_SUPPORT_ARRAY_ATTRIBUTES.
Once that feature flag was enabled the SAML from Okta to Third Party matched the formatting of SAML from Ping to Okta. We are good to go now.