Identity provider attributes

You can map inbound attributes to PingOne user attributes when configuring an external identity provider (IdP) connection to PingOne. You can set up IdP connections to PingOne for social providers (such as Facebook and LinkedIn) or for custom OpenID Connect (OIDC) or SAML IdPs.

Types of attributes you can map

When configuring an external IdP connection in PingOne, you can map the following types of user attributes:

System-provided attributes
Custom declared (string) attributes (single and multivalued)
Custom JSON attributes (single and multivalued)

Learn more in Adding user attributes.

Attribute syntax

Use the syntax guidance in the following sections when mapping inbound IdP attributes to PingOne user attributes for both SAML and OIDC IdP connections.

Standard syntax

When mapping attributes from an external IdP to PingOne user attributes, use the appropriate notation for SAML and JSON.

For example, use the following providerAttributes prefix, rather than samlAssertion:

providerAttributes.<IdP attribute name>

Using the previous example, mapping the email attribute from Facebook to PingOne would use the following syntax:

providerAttributes.email

JSON dot notation syntax

For external IdPs that pass attributes in JSON structure (all external providers except SAML), the syntax for mapping attributes that use JSON dot notation, such as name.family, must use square brackets and single quotes around the attribute name as follows:

providerAttributes['name.family']

SAML versus OIDC attribute mapping

SAML and OIDC both support inbound attribute mapping to PingOne user attributes, but they use different source data formats.

SAML attribute mapping

SAML attributes are XML elements, while PingOne user attributes are JSON objects or an array of objects. Because they use different data formats, you must use an expression to create a valid JSON object in PingOne from the inbound IdP attribute.

Refer to Sample expressions for guidance on using expressions.

OIDC attribute mapping

Both OIDC attributes and PingOne user attributes are JSON objects. Because they use the same data format, you can select a JSON attribute in the attribute mappings list or enter an attribute using the appropriate syntax, such as providerAttributes.mail, as the JSON attribute source.

However, to create more complex attributes, you must use an expression to create a valid JSON object or array of objects in PingOne from inbound attributes.

Refer to the samples in the following sections for guidance on using expressions.

Sample expressions

Before using expressions to map inbound attributes from an IdP, create an external IdP connection in PingOne from Integrations > External IdPs.

Use the sample expressions in the following sections when mapping SAML attributes or complex OIDC attributes:

Custom single-valued JSON attributes
Custom multivalued JSON attributes mapped to multiple JSON objects

Custom single-valued JSON attributes

Use the following example attribute and sample expression to map an inbound IdP attribute to a single-valued PingOne user attribute:

Create a custom single-valued JSON attribute in PingOne with the following example details from Directory > User Attributes:

Field Configuration

Type

JSON

Name

example-jsonSingle

Display Name

example JSON Single

Allow multiple values

Leave cleared.

Example SAML assertion

The expected SAML assertion from the IdP includes the following attributes for a user named John Smith.
Example SAML assertion
<AttributeStatement> <Attribute Name="mail" ...> <AttributeValue ...>jsmith@example.com</AttributeValue> </Attribute> <Attribute Name="groupInfo" ...> <AttributeValue ...>CN=AR,OU=People,DC=example,DC=com</AttributeValue> <AttributeValue ...>CN=AP,OU=People,DC=example,DC=com</AttributeValue> </Attribute> </AttributeStatement>
Map an inbound IdP attribute to your custom single-valued JSON attribute from Integrations > External IdPs.
1. In the PingOne attribute list, select the attribute you previously created.
2. For the IdP attribute, enter the following expression:
  {"mail-in-JSON": providerAttributes.mail,"groupInfo-in-JSON": providerAttributes.groupInfo}
  Example output
  
  The following is the expected output for the attribute.
  Expected output
  { "mail-in-JSON": "jsmith@example.com", "groupInfo-in-JSON": [ "CN=AR,OU=OW,OU=People,DC=example,DC=com", "CN=AP,OU=OW,OU=People,DC=example,DC=com" ] }

Field	Configuration
Type	JSON
Name	`example-jsonSingle`
Display Name	`example JSON Single`
Allow multiple values	Leave cleared.

For a multivalued user attribute, you can use the same expression, and PingOne will wrap the output with square brackets to indicate an array. For example, the following is the output for a multivalued user attribute using the previous example.

Expected output

[
  {
    "mail-in-JSON": "jsmith@example.com",
    "groupInfo-in-JSON": [
      "CN=AR,DC=example,DC=com",
      "CN=AP,DC=example,DC=com"
    ]
  }
]

Custom multivalued JSON attributes mapped to multiple JSON objects

Use the following example and sample expression to map multiple inbound IdP attributes to a multivalued PingOne JSON user attribute:

Create a custom multivalued JSON attribute in PingOne with the following example details from Directory > User Attributes:

Field Configuration

Type

JSON

Name

example-jsonMulti

Display Name

example JSON Multi

Allow multiple values

Select the checkbox.

Example SAML assertion

The expected SAML assertion from the IdP includes the following attributes for a user named John Smith.
Example SAML assertion
<AttributeStatement> <Attribute Name="mail" ...> <AttributeValue ...>jsmith@example.com</AttributeValue> </Attribute> <Attribute Name="groupInfo" ...> <AttributeValue ...>CN=AR,OU=People,DC=example,DC=com</AttributeValue> <AttributeValue ...>CN=AP,OU=People,DC=example,DC=com</AttributeValue> </Attribute> </AttributeStatement>
Map an inbound IdP attribute to your custom multivalued JSON attribute from Integrations > External IdPs.
1. In the PingOne attribute list, select the attribute you previously created.
2. For the IdP attribute, enter the following expression:
  {{"subject-in-JSON": providerAttributes.subject}, {"mail-in-JSON": providerAttributes.mail,"groupInfo-in-JSON": providerAttributes.groupInfo}}
  Example output
  
  The following is the expected output for the attribute with an array containing the multiple mapped objects.
  Expected output
  [ { "mail-in-JSON": "jsmith@example.com", "groupInfo-in-JSON": [ "CN=AR,DC=example,DC=com", "CN=AP,DC=example,DC=com" ] }, { "subject-in-JSON": "john.smith" } ]

PingOne