SAML RegexReplace

Question

I setup SSO for a library portal we use but the vendor wants us to add claims Email, Firstname, Lastname and UserRole. I was able to add everything except for UserRole. They recommended using RegexReplace to add a custom claim like their other clients have done. I tried adding by going to the SSO app that I created, Single Sign on, Attributes & Claims, Add a group claim as they directed me but they still do not see UserRole on their end to assign users a certain role for their license. In the screen shot I posted I do not know what to add in the Regex Pattern to make UserRole to show up on their end.

Answer 1

Hi, this is an example configuration where I return a "UserRole" claim based on the groups - I use regex to remove the prefix of the group:

If there is only one role per user, a more straightforward method of implementation would be to add a regular claim with "Claim conditions" based on groups. In my opinion, this is preferable, as regex can be quite daunting.

I would also recommend verifying the content of the claim yourself. Developers are not infallible - the claim might be present in the token, and the issue could lie with the configuration or application on the other end.

Here’s how you can check the claim content:

1. Open the developer mode in the Edge browser (F12).
2. Switch to the "Network" tab.
3. Enable "Preserve Log".
4. Attempt to log in to the application (it doesn’t have to be successful).
5. Search for "saml" in the network traffic and copy the value from the payload that is sent to the application's reply URL.
6. Decode the token (I personally recommend using samltool.io) and check what is being passed by Entra.

If you update your post to include a screenshot, we can provide more specific feedback on your configuration. Let me know if you have any further questions, and remember to mark the best answer :)