diff --git a/docs/kratos/organizations/organizations.mdx b/docs/kratos/organizations/organizations.mdx index 8011d8226..5bb8615b2 100644 --- a/docs/kratos/organizations/organizations.mdx +++ b/docs/kratos/organizations/organizations.mdx @@ -348,6 +348,37 @@ curl -X PATCH --location "https://api.console.ory.sh/projects/$PROJECT_ID" \ The SAML application callback URL to set at our SAML Identity Provider is: `https://api.console.ory.sh/saml/api/oauth/saml` +#### Data mapping + +You can configure the mapping of SAML attributes to Ory's identity schema using Jsonnet. All custom SAML attributes defined at the +Identity Provider (IdP) will be available in the `raw_claims` object within `claims`. These attributes can then be mapped to the +Ory identity schema. + +:::warning + +Ensure that the appropriate identity schema is created before mapping attributes. The email attribute is natively available in +`claims.email`, everything else is nested under `claims.raw_claims`. + +::: + +#### Example SAML data mapping + +Mapping `firstName` and `lastName` from the SAML Identity Provider to the Ory identity schema (traits). + +```jsonnet +local claims = std.extVar('claims'); + +{ + identity: { + traits: { + email: claims.email, + [if std.objectHas(claims, "raw_claims") && std.objectHas(claims.raw_claims, "firstName") then "firstName" else null]: claims.raw_claims.firstName, + [if std.objectHas(claims, "raw_claims") && std.objectHas(claims.raw_claims, "lastName") then "lastName" else null]: claims.raw_claims.lastName, + }, + }, +} +``` + ### SAML via BoxyHQ :::note