Transformations with Groovy
Starting with version SAML SingleSignOn 4.0.0 and UserSync 2.0, attributes can be transformed using Groovy-scripts.
About Groovy: https://groovy-lang.org/documentation.html
The Groovy-script contains a variable mapping
. This variable is a Map with strings as keys and string-lists as values. In SAML, it contains the attributes from the SAML-assertion sent by the IdP, in UserSync the attributes retrieved by the connector.
After the script is run, the values from the key groovyResult
is taken for the mapped attribute.
Scripts can be configured for any attribute. Theses scripts are independent from each other, each of them gets a fresh copy of the attribute-map.
The NameID-attribute from the SAML-assertion is accessible under mapping.ATTR_NAMEID
.
Each script must finish within 1 second, otherwise its cancelled and a TransformationFailedException
is thrown.
The SLF4J-logger de.resolution.retransform.impl.transformers.groovy.GroovyTransformerScript
is available as logger
.
Examples
Login any user as guestuser
if the attribute groups contains guests. 
This script should be mapped to the Application-attribute Username and assumes that the usernames comes from the SAML Name-ID:
Set the last name to uppercase
This script should be applied to the Application-attribute Full Name and assumes the first name is in first
and the last name in last
Combine groups from attributes with the value true
In this example. the IdP sends a fixed set of group names as keys with the value true if the user is member of that group:
Handle Groups Not Sent As Multivalue Attribute in SAML Response
Transform one group from the SAML response to two or more groups
Transform one group from the SAML response to two or more groups and also perform more direct transformations
Allow user authentication based on the email domain of the user 
For using this script you need to run version 4.0.8 and later as the drop action is not going to work consistently in former versions.
Special Case for SSSOSUP 7515
SAML Single Sign-On is available for Atlassian Server & Atlassian Data Center products.
Our Jira Data Center, Confluence Data Center, Bitbucket Data Center, Jira Server, Confluence Server, Bitbucket Server and other apps are all available on the Atlassian Marketplace.
- Examples
- Login any user as guestuser if the attribute groups contains guests.
- Set the last name to uppercase
- Combine groups from attributes with the value true
- Handle Groups Not Sent As Multivalue Attribute in SAML Response
- Transform one group from the SAML response to two or more groups
- Transform one group from the SAML response to two or more groups and also perform more direct transformations
- Allow user authentication based on the email domain of the user
- Login any user as guestuser if the attribute groups contains guests.