SAML Authentication - Addition to Default Groups

Avatar

Avatar
Validate 10
Level 3
srikanthp689160
Level 3

Likes

20 likes

Total Posts

95 posts

Correct reply

0 solutions
Top badges earned
Validate 10
Validate 1
Ignite 5
Ignite 3
Ignite 1
View profile

Avatar
Validate 10
Level 3
srikanthp689160
Level 3

Likes

20 likes

Total Posts

95 posts

Correct reply

0 solutions
Top badges earned
Validate 10
Validate 1
Ignite 5
Ignite 3
Ignite 1
View profile
srikanthp689160
Level 3

09-10-2020

Hi Team,

I have one question on Default Groups configuration in SAML Authentication Handler. From documentation I understand that if Autocreate CRX Users is checked, Group Membership and is configured with name of attribute in SAML response, user would be added to respective groups after user creation.

On subsequent login attempts if the value in SAML response against Group Membership changes, will the user be removed from earlier group?

For example, user1 is logging for the first time and SAML response contains Group Membership as group1, after successful login, user is added to group1. As part of Business requirement, if user needs to be mapped to a different crx user group group2 and remove from earlier group(group2) then how should SAML response of Group Membership attribute look like?

Just group2 would do? Will this take care of removing user from group1?

 

Is there a way we can test this scenario? Could not think of a way since we do not have access to IDP configuration. Any inputs on open source IDP where we can configure SAML response attributes would be highly helpful.

 

Thanks

Srikanth

View Entire Topic

Avatar

Avatar
Give Back
Level 2
Abdul_Rasheed
Level 2

Likes

5 likes

Total Posts

13 posts

Correct reply

1 solution
Top badges earned
Give Back
Ignite 3
Ignite 1
Validate 1
Boost 5
View profile

Avatar
Give Back
Level 2
Abdul_Rasheed
Level 2

Likes

5 likes

Total Posts

13 posts

Correct reply

1 solution
Top badges earned
Give Back
Ignite 3
Ignite 1
Validate 1
Boost 5
View profile
Abdul_Rasheed
Level 2

09-10-2020

best way to implement user and group administration for SAML would be manage AEM access using local AEM groups and once the SAML groups are synced in AEM, manually map them to these local groups