PingOne

Mapping attributes

You can map PingOne user attributes to SAML or OIDC attributes to and from external applications, resources, identity providers, and provisioning connections.

For example, you could map Email Address in PingOne to NameID in an application.

When mapping multivalued attributes to and from PingOne, consider the following conditions.

  • If you map a multivalued PingOne attribute to an attribute for an external application, the claim in the token or the attribute in the assertion will be multivalued.

  • If you map an external attribute to a PingOne attribute, PingOne will evaluate the mapping as follows:

    • If you map an external multivalued attribute to a multivalued PingOne attribute, PingOne will add all values to the PingOne attribute.

    • If you map an external multivalued attribute to a single-valued PingOne attribute, PingOne uses only the first value of the external multivalued attribute.

    • If you map an external single-valued attribute to a multivalued PingOne attribute, PingOne will take the single value and add it to the multivalued PingOne attribute to create a multivalued attribute containing one value.

For more information about the expression builder, see Using the expression builder.

Using attribute mapping

You can map PingOne attributes to attributes in your application, resource, identity provider, or provisioning connection.