Customize SAML Assertions

You can customize your SAML assertions as well as the SAML and WS-Federation protocol parameters.

Customize SAML assertions when Auth0 acts as the identity provider by configuring the addon in the Dashboard or by using rules.

1. Go to Dashboard > Applications > Applications and select the name of the application to view.

2. Select the Addons tab.

3. Enable SAML2 Web App toggle to view settings and options.

   

4. In the Settings tab, you can make several types of customizations, such as:

   1. Specify an audience other than the default issuer of the SAML request.

   2. Specify a recipient.

   3. Map profile attributes to specific attribute statements.

   4. Change the signature or digest algorithm.

   5. Specify whether just the assertion or the entire response should be signed.

You can use rules to add more extensive or dynamic customizations to the SAML response. Customizations done in rules override customizations done using the Application Addons view in the Dashboard.

The context.samlConfiguration.mappings object is used to override default SAML attributes or add new attributes. The object keys are the name of the SAML attribute to override or add and the values are a string of the user object property to use as the attribute value.

function (user, context, callback) {
  // change SAML token lifetime to 10 hours
  context.samlConfiguration.lifetimeInSeconds = 36000;

  // if available, use upn as NameID
  if (user.upn) {
    context.samlConfiguration.mappings = {
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "upn" // use user.upn as the value
    }
  }

  callback(null, user, context);
}

function (user, context, callback) {
  user.user_metadata = user.user_metadata || {};
  user.user_metadata.color = "purple";
  context.samlConfiguration.mappings = {
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/color": "user_metadata.color", // use user.user_metadata.color as the value
  };
  callback(null, user, context);
}

The following is a list of customization attributes for SAML assertions.

• Troubleshoot SAML Configurations
• Troubleshoot SAML Errors
• Configure SAML Identity Provider-Initiated Single Sign-On