Question

SAML Module - User Management

0

E.g. In my domain model there are 2 entities: “Worker” and “Planner” (These are alse the user roles in the app). Both userroles use the same IdP-configuration to redirect to an Authentication-Mechanism (external to mendix). When they succesfully authenticate they are redirected back to the MxApp where an account is retrieved or created. However, in the IdP-configuration I can’t know which role I’ll be getting back, so I can’t know which entity I need to map the attribute to (entity Worker or Planner). Any idea on how to solve this?

asked 2020-10-30

Jannes Houben

2 answers

Daan Verweij · Answer 1 · 2020-11-13

Hi Jannes,

Your question is a little unclear, so please elaborate if I misunderstood.

The SAML module allowes to add microflow logic before or after logging in. These are the CustomUserProvisioning and CustomAfterSigninLogic. You can select this at the Provisioning tab of your IdP-configuration. This way you can use the normal microflow debugger and breakpoints, which probably makes solving your problems easier and more intuitive.

The CustomUserProvisioning has a list of AssertionAttributes which contain all information given from the external Authentication Mechanism. You can probably derive from there which entity you should use and map accordingly. Hope this helps.

Jannes Houben · Answer 2 · 2020-11-23

Sorry for the late response.

So, as an anonymous user i get to see the custom login page. On this page the anonymous user can choose to login as and internal employee or external employee. When clicking the “intern employee” there are 2 related project roles. “Worker” and “planner”. I created a module for UserManagement where I created an entity “Worker” and “Planner” (both are generalizations of “Administration.Account”). Each entity (“Worker” and “Planner”) has it’s own specific attributes and associations.

The problem is, when I configure the SAML module, I have to set the entity on which I want to map the assertion attributes. But I cannot know this entity since I don’t know which role I’ll be getting back from the identity provider.

In other words:
- When I login as an Internal Employee, and I get the user role Worker back from the IdP, the assertion attributes should be mapped on the entity “Worker”.
- When I login as an Internal Employee, and I get the user role Planner back from the IdP, the assertion attributes should be mapped on the entity “Planner”.