SAML Single Sign-OnSAML Single Sign-On
Try For Free

Transformations with Groovy

Starting with version SAML SingleSignOn 4.0.0 and UserSync 2.0, attributes can be transformed using Groovy-scripts.

About Groovy: https://groovy-lang.org/documentation.html

The Groovy-script contains a variable mapping. This variable is a Map with strings as keys and string-lists as values. In SAML, it contains the attributes from the SAML-assertion sent by the IdP, in UserSync the attributes retrieved by the connector.

After the script is run, the values from the key groovyResult is taken for the mapped attribute.

Scripts can be configured for any attribute. Theses scripts are independent from each other, each of them gets a fresh copy of the attribute-map.

The NameID-attribute from the SAML-assertion is accessible under mapping.ATTR_NAMEID.

Each script must finish within 1 second, otherwise its cancelled and a TransformationFailedException is thrown.

The SLF4J-logger de.resolution.retransform.impl.transformers.groovy.GroovyTransformerScript is available as logger.

Examples

Login any user as guestuser if the attribute groups contains guests. 

This script should be mapped to the Application-attribute Username and assumes that the usernames comes from the SAML Name-ID:

  1. // Check the group-attribute for the entry "guests"
  2. if(mapping.groups.contains("guests")) {
  3. // Write the static value "guestuser" to groovyResult.
  4. // [] are required because the values are lists
  5. mapping.groovyResult = ["guestuser"]
  6. } else {
  7. // Otherwise use the value from the Name ID
  8. // no [] needed because the value in the mapping is already a list
  9. mapping.groovyResult = mapping.ATTR_NAMEID
  10. }

Set the last name to uppercase

This script should be applied to the Application-attribute Full Name and assumes the first name is in first and the last name in last

  1. // If the attribute lastName is present transform it to uppercase,
  2. // otherwise used an empty string
  3. def lastName = mapping.lastName[0] ? mapping.lastName[0].toUpperCase() : ""
  5. // Groovy GStrings allow variable substition with $variable or ${expression}
  6. // toString() is required here because GStrings must be explicitly turned into Java-Strings.
  7. def fullName = "${mapping.firstName[0]} $lastName".toString()
  9. // The SLF4J-logger de.resolution.retransform.impl.transformers.groovy.GroovyTransformerScript
  10. // is available as logger and can be used to write to the application-log.
  11. // warn is enabled by default, so this message should be visible in the log
  12. logger.warn("########## This is the new full name: {}",fullName)
  14. // Wrapping the value into a list
  15. mapping.groovyResult = [fullName]

Combine groups from attributes with the value true

In this example. the IdP sends a fixed set of group names as keys with the value true if the user is member of that group:

  1. "attributes": {
  2. "grp1": [ "true"],
  3. "grp2": [ "true"],
  4. "grp3": [ "false"]
  5. },


  1. def groups = []
  3. if(mapping.grp1.contains("true")) {
  4. groups.add("grp1");
  5. }
  6. if(mapping.grp2.contains("true")) {
  7. groups.add("grp2");
  8. }
  9. if(mapping.grp3.contains("true")) {
  10. groups.add("grp3");
  11. }
  13. logger.warn("Groups are {}", groups)
  15. mapping.groovyResult = groups

Handle Groups Not Sent As Multivalue Attribute in SAML Response

  1. def trafoMap = ["20368564" : "stash-users", "10096280" : "other-group"] // list of key/ value to replace group names after splitting
  2. def splitted = mapping.Groups[0].split(",") // read "Groups" attribute from SAML Response split by comma
  3. mapping.groovyResult = splitted
  4. .collect{trafoMap[it]} // apply transformation rules from trafoMap (search and replace)
  5. .findAll{it} // filter null values a.k.a. drop groups not in the trafoMap


Transform one group from the SAML response to two or more groups

  1. // Input your data as per the descriptions below
  2. // Replace YourIDPGroupAttribute with your actual IdP Group Attribute
  3. def idpGroupAttribute = "YourIDPGroupAttribute"
  5. // Replace IdP_groupName with the group name that you need to transform
  6. def idpGroupName = "IdP_groupName"
  8. // Replace "replacement1" and "replacement2" with the actual group names replacements, and you can add other elements if needed
  9. def replacements = ["replacement1", "replacement2"]
  11. // No need to change anything in the following section
  12. def groups = mapping.get(idpGroupAttribute)
  13. if (groups.contains(idpGroupName)) {
  14. groups.remove(idpGroupName)
  15. groups.addAll(replacements)
  16. }
  17. mapping.groovyResult = groups

Transform one group from the SAML response to two or more groups and also perform more direct transformations

  1. // Input your data as per the descriptions below
  2. // Replace YourIDPGroupAttribute with your actual IdP Group Attribute
  3. // The example below is the Azure AD Default groups claim
  4. def idpGroupAttribute = "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"
  6. // Replace IdP_groupName_1 with the group name that you want to transform into multiple other groups
  7. def idpGroupName_1 = "my-group-1"
  9. // Add as many groups as you want to be assigned to the user, if idpGroupName_1 is present
  10. def idpGroupName_1_transform_to_groups = ["your-group-1", "your-group-2"]
  12. // No need to change anything in the following block, this takes
  13. def groups = mapping.get(idpGroupAttribute)
  14. if (groups.contains(idpGroupName_1)) {
  15. groups.remove(idpGroupName_1)
  16. groups.addAll(idpGroupName_1_transform_to_groups)
  17. }
  19. // Add more 1:1 replacements here
  20. def idpGroupName_2 = "transform-me-1"
  21. def idpGroupNameReplacement_2 = "your-group-3"
  23. if (groups.contains(idpGroupName_2)) {
  24. groups.remove(idpGroupName_2)
  25. groups.add(idpGroupNameReplacement_2)
  26. }
  29. def idpGroupName_3 = "transform-me-2"
  30. def idpGroupNameReplacement_3 = "your-group-4"
  33. if (groups.contains(idpGroupName_3)) {
  34. groups.remove(idpGroupName_3)
  35. groups.add(idpGroupNameReplacement_3)
  36. }
  38. // returns all the groups
  39. mapping.groovyResult = groups


Allow user authentication based on the email domain of the user 

  1. // Check the email-attribute and if it is not empty check if it contains the email domain
  2. if (mapping.email[0] != null) {
  3. if (mapping.email[0].contains("@lab.resolution.de")) {
  4. // if it contains the domain write the value of the nameID to groovyResult
  5. // [] are required because the values are lists
  6. mapping.groovyResult = mapping.ATTR_NAMEID
  7. } else {
  8. // Otherwise drop the authentication
  9. // no [] needed because the value in the mapping is already a list
  10. mapping.drop = true
  11. }
  12. } else {
  13. // if email-attribute and if it is empty drop the authentication and log a warning message
  14. mapping.drop = true
  15. logger.warn("Dropping User authentication due to missing SAML attribute email")


For using this script you need to run version 4.0.8 and later as the drop action is not going to work consistently in former versions.


Special Case for SSSOSUP 7515
  1. //// FOR TESTING IN https://groovyconsole.appspot.com, remove this part
  2. def mapping = [
  3. //"mail": ["mail@example.com"],
  4. //mail : [],
  5. mail: ["bla@fasel.onmicrosoft.com"],
  6. "extension_372c480931744b6c933a94ee08b563b2_extensionAttribute15" : ["ext@example.com"],
  7. "userPrincipalName" : ["upm@example.com"]
  8. ]
  9. //////
  11. // ?. is a safe dereference, if mail is not present just return null instead of throwing an error
  12. def mail = mapping?.mail?.getAt(0)
  13. def ext = mapping?.extension_372c480931744b6c933a94ee08b563b2_extensionAttribute15?.getAt(0)
  14. def upn = mapping?.userPrincipalName?.getAt(0)
  16. // use userPrincipalName if nothing else is set
  17. if(!mail && !ext && upn) {
  18. mapping.groovyResult = [upn]
  19. // If extension... is set and mail is not set or matches onmicrosoft.com use that value
  20. } else if(ext && (!mail || mail =~ /onmicrosoft.com/) ) {
  21. mapping.groovyResult = [ext]
  22. // If extension is not set but mail matches onmicrosoft.com use special replacements
  23. } else if(!ext && mail =~ /onmicrosoft.com/) {
  24. switch (mail) {
  25. case ~/abc@def.onmicrosoft.com/:
  26. mapping.groovyResult = ["abc@def.com"]
  27. break
  28. case ~/bla@fasel.onmicrosoft.com/:
  29. mapping.groovyResult = ["bla@fasel.com"]
  30. break
  31. default:
  32. mapping.groovyResult = ["default@example.com"]
  33. }
  34. } else if (mail) {
  35. mapping.groovyResult = [mail]
  36. } else {
  37. // drop the user if nothing matches
  38. mapping.drop = true
  39. }
  41. //////// for testing, remove this
  42. return mapping




This site uses cookies to deliver its service & to analyse traffic. By browsing this site, you accept the privacy policy.

Our Wiki uses cookies

We want to give you the best possible experience on our website. For this we use technically required cookies and, if you agree, cookies for analysis and marketing purposes. You can find more information about the cookies in our Privacy Policy. By tapping ‘Accept All,’ you consent to the use of these methods by us and third parties.

Necessary
Always Active
Analytics
Advertisement
Other