Multivalued attributes

Questions SAML
1

Hi there.

I’m looking to make a multi-valued attribute based on several isMemberOfGroupName() functions to provide custom output. Because of this, I can’t use the group attribute statement functionality. The closest I’ve been able to get is creating a new array, but I really don’t want an array - I want a multi-valued attribute… like below

<saml2:Attribute Name="groups"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                             >
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >g1</saml2:AttributeValue>
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xs:string"
                                      >g4</saml2:AttributeValue>
            </saml2:Attribute>

I’m hoping it’s something silly I’ve overlooked, but I can’t seem to get it to work. Has anyone had any success?

2

I’ll include the SAML chunk that applies, maybe that’ll shed some light.

“gid” is an attribute statement we’re generating in the application that references the “appuser.gid” value. Appuser.gid is an array using the function:

> Arrays.flatten(isMemberOfGroupName("adm-test1") ? "test1" : "",isMemberOfGroupName("adm-test2") ? "test2" : "",isMemberOfGroupName("adm-test3") ? "adm-test3" : "")

I can make an API call and see it right there in the app user profile:

> "profile": {
>     "gid": [
>         "test1",
>         "test2",
>         ""
>     ]

I included both the attribute statement, and the group attribute statement for comparison. I’m not sure if it’s the Arrays.flatten() function that’s screwing with it, but I can’t really create an array with anything else that I can see.

<saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml2:Attribute Name="**gid"
                     NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                     >
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xs:string"
                              >test1,test2,</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="groupattributestatement"
                     NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
                     >
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xs:string"
                              >adm-test1</saml2:AttributeValue>
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xs:string"
                              >adm-test2</saml2:AttributeValue>
    </saml2:Attribute>
</saml2:AttributeStatement>
3

What is your Okta Org name you are using? We have an opt-in feature that changes the way we process multi-value SAML attribute statements and might be what you are looking for.

4

For future reference, the Early Access feature flag is called “SAML_SUPPORT_ARRAY_ATTRIBUTES” which Okta support can enable. It serializes any UD Array attribute as a multi-value SAML attribute statement instead of as a CSV. We added a new Okta EL function to convert Array to CSV if you still need that functionality for an existing app.

5

Hello! I’m basically trying to do the same thing. I’ve asked Okta support to enable the “SAML_SUPPORT_ARRAY_ATTRIBUTES” and they say that they have, but I’m not sure how to get it to work. I’ve tried using Arrays.flatten(“a”, “b”) as the value of my attribute statement, but I just get the literal string Arrays.flatten("a", "b") as the saml2:AttributeValue, rather than two saml2:AttributeValues.

  1. How can I verify that the flag has actually been turned on for my account?
  2. What should I type into the Value field in the Attribute Statements section of my SAML app to get multiple AttributeValue fields in my SAML assertion?