Awx: RFE: SAML Attribute Mapping to Specific Teams and Organizations

[jamesmarshall24]

ISSUE TYPE

• Feature Idea

COMPONENT NAME

• API
• UI

SUMMARY

Allow mapping of SAML attributes to map to team and organization names that do not match attribute_value.

ADDITIONAL INFORMATION

For example,

When mapping users with SAML attribute "ansibleOrganizations" and mapping attribute_value "developer-unix-org" to the organization "Unix Developers"

{
    "saml_attr": "ansibleOrganizations",
    "saml_admin_attr": "ansibleOrganizationAdmins",
    "remove": true,
    "remove_admins": true,
    "org_map": [
    {
        "organization": "developer-unix-org",
        "org_alias": "Unix Developers"
    }
  ]
}

When mapping users with SAML attribute "ansibleGroups" and mapping attribute_value "unix-adms" to the team "Unix Administrators":

{
    "saml_attr": "ansibleGroups",
    "remove": true,
    "team_org_map": [
    {
        "team": "unix-adms",
        "organization": "Default",
        "team_alias": "Unix Administrators"
    }
  ]
}

[wenottingham]

While keeping this open, we recommend to have the team names match, or doing this translation on the SAML provider.

[gforster]

This would be incredibly helpful for when the SAML IDP uses LDAP. e.g - Our team names end up looking like this: cn=SOMEGROUP,ou=groups,dc=our,dc=org,dc=com

[paylocity-sflanders]

This really needs to be supported. tower should have a way to map external saml attributes to team names. otherwise if a AD group name is changed you may have an enormous amount of changes to make if your are storing the configuration of tower in source

[patrykk]

Hi, do you have any plans to implement this functionality soon? We keep group names in the LDAP and we couldn't translate them directly to the team names.

[chuegel]

I also look forward to see this implemented.

[one-t]

Tested - this is now working as expected