# SAML assertion UserID

**URL:** <https://devforum.okta.com/t/saml-assertion-userid/8080>\
**Category:** SAML\
**Created:** [February 13, 2020, 6:31am UTC](https://devforum.okta.com/t/saml-assertion-userid/8080 "2020-02-13T06:31:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pett](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@Pett](https://devforum.okta.com/u/Pett)\
**Post date:** [February 13, 2020, 6:31am UTC](https://devforum.okta.com/t/saml-assertion-userid/8080/1 "2020-02-13T06:31:51Z")

</div>

For some reason Okta SAML assertion returns user email as NameID even when “Persistent” type is selected.  
User email is not really an immutable property and can be renamed for example. So we need a more “persistent” user ID instead like the Okta user ID (which is BTW correctly returned by OpenID connector).

Any ideas how to get user ID through SAML auth?

---

<div class="post-metadata">

**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\
**Post date:** [February 13, 2020, 8:09am UTC](https://devforum.okta.com/t/saml-assertion-userid/8080/2 "2020-02-13T08:09:38Z")

</div>

On the Sign On tab you can change the mapping (including custom where you can use expression language):

![image](https://global.discourse-cdn.com/oktadev/original/2X/8/8bf91d3fa21107c8a41b55fdc34cf15d4392cc14.png)

---

<div class="post-metadata">

**Author:** ![Pett](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@Pett](https://devforum.okta.com/u/Pett)\
**Post date:** [February 13, 2020, 4:42pm UTC](https://devforum.okta.com/t/saml-assertion-userid/8080/3 "2020-02-13T16:42:03Z")

</div>

Govner,

Sorry, can you please clarify whether you mean “Application username” dropdown?  
Setting it to “okta username” didn’t help.  
I still don’t see userID similar to this one (00u25f75zPX9RN32c4x6) anywhere …

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [February 17, 2020, 7:31am UTC](https://devforum.okta.com/t/saml-assertion-userid/8080/4 "2020-02-17T07:31:25Z")

</div>

Hi @Pett

Please navigate in your Okta administrative dashboard to Users/Directory \>\> Profile Editor \>\> your application \>\> Mappings \>\> Okta to _your application_ \>\> and, for the section `Username is set by *your application*`, press` Override with mapping` and add the following expression `user.getInternalProperty("id")`.

Here is an example on how it would look like when previewing the assertion:

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/f/fd1c7b29e366445ded8ca0b0a31f4a5580638eb7.png)

---

<div class="post-metadata">

**Author:** ![Pett](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@Pett](https://devforum.okta.com/u/Pett)\
**Post date:** [March 6, 2020, 5:25am UTC](https://devforum.okta.com/t/saml-assertion-userid/8080/5 "2020-03-06T05:25:31Z")

</div>

Hi @dragos,

Thanks a lot for your reply!  
Do you know if it is possible to get also GSuite user ID provisioned by Okta this way?  
We have to match a user logged in via Okta and GSuite resources corresponding to that user (we provide access to). Checking just an email seems to be insecure as anyone can create such a formal identity in 3rd party IDP or even Okta directly.  
Any ideas on that?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 23, 2024, 10:46pm UTC](https://devforum.okta.com/t/saml-assertion-userid/8080/6 "2024-01-23T22:46:54Z")

</div>