...
| Inhoudsopgave | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
In addition to the above, the govconext application expects a few more attributes to be passed back in the SAML response, which are shown below. For a more elaborate overview and classification, please see the attributes overview. These attributes are also pre-populated but you can review them as per your requirements. Below is the list, and after the list an instruction on how to enter them. The attributes shown in bold are mandatory:
Name | Source Attribute |
urn:mace:dir:attribute-def:cn eduPersonPrincipalName | user.displayname userprincipalname* |
urn:mace:dir:attribute-def:displayName uid | user.displayname userprincipalname |
urn:mace:dirterena.org:attribute-def:eduPersonPrincipalName schacHomeOrganization (this one requires manipulation, please read on) | A manipulation of: user.userprincipalname* (see further) |
urn:mace:dir:attribute-def:givenName cn | user.givenname displayname |
urn:mace:dir:attribute-def:mail displayName | user.mail displayname |
urn:mace:dir:attribute-def:preferredLanguage givenName | user.preferredlanguage givenname |
urn:mace:dir:attribute-def:sn | user.surname |
urn:mace:dir:attribute-def:uid mail | user.userprincipalname mail |
urn:mace:dir:attribute-def:eduPersonAffiliation preferredLanguage | user.extensionattribute1** preferredlanguage |
urn:mace:dir:attribute-def:eduPersonScopedAffiliation Join(user.extensionattribute1, "@[yourorganisationdomain].nl")*eduPersonAffiliation | fixed text value ‘employee’ (without ' ', Microsoft will automatically add “ “) |
urn:mace:terena.orgdir:attribute-def:schacHomeOrganization | A manipulation of: user.userprincipalname* in the form: employee@[schacHomeOrganization]* (see further) |
| Informatie |
|---|
*) if your EntraID tenant contains multiple domains, always the correct domain belonging to the specific user must be sent in this attribute |
Add an attribute
| Informatie |
|---|
...
**) your organization might use a different attribute for a ‘role’. It is possible to fixate this attribute to the literal text ‘employee’, see attributes
for more information: see the wiki page attributes |
For each of the claims in the table above, you need to go through the following steps.
Attributes that are exact copies of EntraID claims can easily be created based on the instruction in the next paragraph.
Attribute mappings that require manipulation are explained in the subsequent sections.
Add an attribute with a 1:1 mapping
In the box ‘Attributes & Claims’, click ‘Edit’.
...
Enter the claim name (first column in the table above) in the ‘Name’ field and select the Source attribute that you found in the second column in the table above:
...
For urn:mace:dir:attribute-def:eduPersonAffiliation it is sufficient to simply type ‘employee’ in the source attribute field without the quotes, Microsoft will automatically put the word in double quotes.
Repeat the steps for every attribute mentioned in the table above.
Add the manipulated attribute: schacHomeOrganization
The urn:mace:terena.org:attribute-def:schacHomeOrganization is slightly more complex:
...
In the Manage transformation page, perform the following steps:
...
Select Extract() from the dropdown in Transformation field and click After matching button.
Select Attribute as a Parameter 1 (Input).
In the Attribute name field, select user.userprinciplename from the dropdown.
Select @ value from the dropdown.
Click Add.
Please add the default SchacHomeOrganization(s) used within your organization in the form ‘Technisch Intakeformulier govconext’ (usually the same as the main e-maildomain.nl). If your tenant contains multiple organizations, please provide each schacHomeOrganization in the table including their formal name, like Organisatie X and Y in the example below. If you serve multiple organizations that each have their own tenant, you can add them to the same table, like Organisatie Y and Z in the example below:
Organisatienaam in WAYF overzicht*: | Metadata URL*: | SchacHomeOrg**: | govguest | getgovroam | govvpn |
Organisatie X* | https://orgX.nl/metadata http:// | domainX.nl | j | j | n |
Organisatie Y | n | j | n | ||
Organisatie Z | n | j | j |
The SAML configuration in EntraID (AAD) is now ready.
Add the manipulated attribute: eduPersonScopedAffiliation
The Affiliation attribute contains a role that can be set to ‘employee’ by default. The ScopedAffiliation attribute should also add the domain of the user, which is in fact the same as schacHomeOrganization. This can be achieved by a transformation of the type ‘RegexReplace()’ with:
Regex pattern: ^.*\@(?'domain')
Replacement pattern (vervangingspatroon): employee@{domain}
...
Submit the intake form
Please complete the form ‘Technisch Intakeformulier govconext’ with the metadata-URL and default schacHomeOrganization and the other required information and send it through the govroam ‘klantportaal’ and/or ‘tech@govroam.nl’.
...
Once govconext is setup by stichting govroam, you will receive a notification that it is ready to use, and you can then log in to the govroam services that your organization subscribed to via your own IdP. …
Please test
You can then test the authentication and attribute mappings by browsing to:
govconext-Acceptatie: https://
...
...
govconext-Productie: https://govconext.nl/debug
…and then search for your organization, after which you can login at your own organization. After that, the debug page should look like the screenshot below. The first four default Microsoft claims will be validated as a warning (yellow symbol) which you can ignore. All others must be validated correctly with a green symbol:
...
If the claims cannot be correctly validated, please check the steps above and reload the debug page until all required claims are correctly validated. If you’re in doubt, you can press the button ‘Mail naar govconext’ to have them checked.
Allow access to desired Service Providers
...