IAM Configuration: Mapping a specific user field to Snipe-IT field?

[mmartinescu]

I'm in the process integrating Snipe-IT with our institution's SSO using SAML. I'm trying to map a attribute provided by the SSO service (call it instPersonID) to Snipe-IT's Employee No. field. Is that possible using Snipe-IT's SAML Custom Settings or maybe LDAP Sync? If yes, how?

In our SSO system, the username is mutable: users can request to change their usernames. Hopefully not too often but it does happen. There is another property on the SAML side, instPersonID, that is immutable and unique for each user. Hence why I want to put that attribute in the Employee No. field in Snipe-IT. Essentially: if a user changes their username on our side (e.g. from jsmith to johnsmith), how does that affect the LDAP sync on the Snipe-IT side? Will there now be two accounts in Snipe-IT?

Thanks in advance!

[uberbrady]

No, we ignore all of the additional attributes, all we care about is Username on the Snipe-IT side, and (usually) NameId on the SAML side. You can also pick a different attribute for us to match up to the username, but that's all we care about.

For employee ID and various other things, we'll only really care about them when doing an LDAP userlist sync.

[adagioajanes]

@mmartinescu is there any specific reason you are utilizing the employee id number, and not the username to perform the SAML authentication?

Another question: if a user changes their username on our side (from jsmith to johnsmith), how does that affect the LDAP sync on the Snipe-IT side? Will there now be two accounts in Snipe-IT?

I am also interested in this.

[mmartinescu]

@adagioajanes I guess you're right, I could just use the username for authentication. The more important thing is synchronizing the Snipe-IT users with our side, which has the aforementioned challenge.

[mmartinescu]

(I updated the question with the information from the comments.)

[mmartinescu]

@uberbrady On this topic, I'm trying to use a attribute other than NameID. Here's how it's formatted in the SAMLResponse (which I got from the Chrome Dev tools):

<saml2:AttributeStatement>
  <saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
    <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">some_username</saml2:AttributeValue>
  </saml2:Attribute>
  <!-- Other AttributeStatements here -->
</saml2:AttributeStatement>

How do I access this Attribute? Specifying uid instead of NameID didn't seem to work.

Thanks.

[mmartinescu]

Never mind, I figured it out; I used the Name instead of the FriendlyName (e.g. urn:oid:0.9.2342.19200300.100.1.1 instead of uid).