Attributes#

Attributes represent individual pieces of user information that the SAML IdP Profile can include in SAML assertions issued to Service Providers. Service Providers may use these attributes for authorization decisions or to personalize the user experience.

Attributes can be managed individually or as part of Attribute Groups. While Attribute Groups make it easier to organize and select related attributes, each attribute is ultimately included or excluded in the assertion based on your configuration.

Use Cases#

Some common use cases for attributes in SAML assertions include:

• User Profile Data: Attributes like name, address can help the Service Provider to personalize the user experience
• Authorization: Attributes like roles, groups can be used by the Service Provider to make authorization decisions
• Computed Attributes: Attributes that are derived from other attributes or external data sources can be included to provide additional context about the user
• Organized Attribute Management: Using Attribute Groups allows for easier organization and management of attributes. For example by grouping together all personal it is easy to selectively allow these attributes to be included in an assertion for some Service Providers, while excluding them for others.

Configure an Attribute#

To create an attribute using the Admin UI, navigate to the SAML IDP Profile you want to configure, and go to the “Attributes” section.

Select the Create Attribute button or the + New button next to the Attributes heading to open the attribute creation form. Enter a name for the attribute and select Create.

To configure how the attribute’s value is populated, select the pencil icon next to its name to open the attribute configuration form. There, you can define the description, choose a value source, and apply optional transformations. For more information on configuring attribute value sources, see Attribute Value Providers

Attribute Group#

Attribute Groups in the SAML IDP Profile allow you to manage related attributes as a set. An Attribute Group is simply a collection of attribute names that can be selected together, making it easier to configure which attributes are included in SAML assertions.

When configuring attributes for a SAML assertion, you can select entire attribute groups or choose individual attributes. Selecting an attribute group will include all attributes in that group in the assertion, while also allowing you to add or remove individual attributes for fine-grained control.

Attribute Groups do not perform any logic beyond grouping attribute names, they are a convenience for configuration and management.

Configure an Attribute Group#

To create or manage Attribute Groups in the Admin UI, navigate to the SAML IDP Profile you want to configure, and go to the “Attributes” section.

Select + New next to Attribute Groups section, give the group name and optional description.

To assign an attribute to a group select + Add Attributes to Group under Attributes section.