Set up custom mapping for authentication provider#

#Objective

Custom mappings allow you to automatically assign existing Data Platform groups or roles (or auto-create them if they don't exist) to users signing in through that authentication provider.

Click on Add in the Custom Mapping panel to set up a new mapping.

#Normal mode

With the normal mode, you can assign existing groups or roles to users signing in from the authentication provider.

To do this, choose between Role and Group, and select the role/group from the selection.

By default, it will assign the role/group to all new users imported from the authentication provider, but you can set a condition on the binding.

Conditions are based on fields coming from the authentication providers response.
An example of condition is:

{
    "user.jobTitle": {
        "eq": "Admin"
    }
}

This condition will look the field user.jobTitle in the authentication response for any new user signing in from the authentication provider, and check if the value is equal to Admin. If true, it will bind the role/group to that user, otherwise it won't.

Conditional operators are:

• eq: Equal to the value
• ne: Not equal to the value
• in: In the set of value
• nin: Not in the set of value
• lt, lte, gt, gte: Lower than, Lower or equal to, Greater than, Greater or equal to
• regexp: Will try to match the auth response field with the value (regex)

#JSON mode

With the JSON mode, you can dynamically assign or create groups or roles for users signing in from the authentication provider. Switch to the JSON mode in the header of the window to activate it.

#Assign existing roles/groups

The binding of existing groups/roles with conditions is carried out using the if keyword.

{
  "group": "_identifier_of_the_group",
  "if": {
    "organization.name": { 
      "eq": "Example Corp"
    }
  }
}

#Dynamically find or create roles/groups

You can dynamically define bound resources using the option bind. It takes in 5 possible parameters:

• upsert: false/true
  • if true: It will autogenerate groups/roles if they don't already existing in the Identity Access Manager
  • if false: It will only bind to existing groups/roles
• input: It's a JSON path accessor to get the list of "resources to bind"
• split: In some cases, you could have such a field in the answer: "group1,group2,group3". By inputting "," it will automatically split the list using the commas as separator
• match: see below
• replace: see below

#Use the match parameter

You can take only some groups matching a specific regex pattern.

For example, if the authentication provider has the following groups: PRIVATE_ADMIN, IAM_APP_GROUP1, IAM_APP_GROUP2, then the following configuration will only create the 2 groups starting by "IAM_APP".

{
    "input": "$.memberships[*].displayName",
    "match": 'IAM_APP_.*'
}

With that configuration I will only get the 2 group starting by IAM_APP

#Use the replace parameter

The replace parameter can only be used if there is a "match" pattern set. It allows you to rename the groups created, using regex capturing groups:

{
    "input": "$.memberships[*].displayName",
    "match": 'IAM_APP_(.*)',
    "replace": '$1'
}

In the previous example, it will create groups called "GROUP1" and "GROUP2" in the Identity Access Manager instead of the full name.

#Three examples

For instance, you can bind organizations' name to IAM groups:

{
  "bind": {
    "upsert": false, // if set to true, it will create the field automatically
    "input": "$.organizations[*].name", // JSON path accessor to input elements
    "split": null // Optional, if set, it will try to split every value with the value in delimiter
    "match": ".*", // Optional, it will match the value found in input with that regexp
    "replace": "$0" // Optional, it will replace the input with that pattern before setting it as name for group/role.
  }
}

This configuration will automatically create new groups from user's memberships:

{
  "bind": {
    "upsert": true,
    "input": "$.memberships[*].displayName"
  }
}

This example configuration:

• looks for $.user.isMemberOf field
• splits values using comma (,)
• for each value:
  • checks if it matches a regular expression starting with APP_MY_DASHBOARD_ and capturing the end
  • replaces by APP_ and the captured value
  • as upsert is false, checks whether that group does exist in IAM and bind users to that group

{
  "bind": {
    "upsert": false,
    "split": ",",
    "input": "$.user.isMemberOf",
    "match": "APP_MY_DASHBOARD_([\\w-]*)",
    "replace": "APP_$1"
  }
}

#Go further

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

Ask questions, give your feedback and interact directly with the team building the Data Platform on the dedicated Discord channel.

If you need support with your OVHcloud services, create a request in our Help Centre.

Join our community of users.