PingOne Advanced Identity Cloud

SP account mapper scripting API

The following bindings are available to SP account mapper scripts.

The SP account mapper script is a next-generation script and therefore has access to all the next-generation common bindings in addition to those described here.
Binding Description

accountMapperHelper

The helper object contains supporting methods that provide context information when customizing account mapping on the SP.

public Map<String, Object> getNameID()

Returns the NameID from the assertion as a map.

public boolean isTransientNameId(String nameIDFormat)

Returns a boolean indicating whether the NameID format is transient.

public String getTransientUserForSP()

Returns the transient user ID.

public boolean useNameIDAsSPUserID()

Returns true if the NameID should be used as the SP user ID.

public boolean isAutoFedEnabled()

Returns true if auto-federation is enabled for the entity.

public void validateUserId(String userId)

Validates the user ID.

public String getAutoFedUser(String defaultValue)

Returns the user for the auto-federation attribute or the default value if not found.

assertion

The SAML 2.0 assertion as a map of values.

Example assertion map 
{
    "version": "2.0",
    "issueInstant": 1758805815000,
    "subject": {
        "subjectConfirmation": [
            {
                "subjectConfirmationData": {
                    "elementName": "SubjectConfirmationData",
                    "mutable": false,
                    "notOnOrAfter": 1758806415000,
                    "inResponseTo": "s29f426899dd94932aec220d3294c7b1ee964b54f7",
                    "content": [
                        ""
                    ],
                    "recipient": "https://sp.example.com:18080/am/Consumer/metaAlias/alpha/sp1",
                    "notBefore": null,
                    "address": null,
                    "contentType": null
                },
                "method": "urn:oasis:names:tc:SAML:2.0:cm:bearer",
                "nameID": null,
                "mutable": false,
                "encryptedID": null,
                "baseID": null
            }
        ],
        "nameID": {
            "@class": "com.sun.identity.saml2.assertion.impl.NameIDImpl",
            "value": "KR0XstW8C97SHPfusdTrTphgbiCo",
            "nameQualifier": "idp1",
            "format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
            "mutable": false,
            "spnameQualifier": "sp1",
            "spprovidedID": ""
        },
        "mutable": false,
        "encryptedID": null,
        "baseID": null
    },
    "advice": null,
    "signature": "<ds:Signature ...</ds:Signature>",
    "conditions": {
        "notOnOrAfter": 1758806415000,
        "conditions": [],
        "audienceRestrictions": [
            {
                "audience": [
                    "sp1"
                ],
                "mutable": false
            }
        ],
        "oneTimeUses": [],
        "proxyRestrictions": [],
        "notBefore": 1758805215000,
        "mutable": false
    },
    "id": "s2637ff7cd391dda376a66738031d7fbd63771debd",
    "statements": [],
    "authnStatements": [
        {
            "authnContext": {
                "authnContextClassRef": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                "authnContextDecl": null,
                "authnContextDeclRef": null,
                "authenticatingAuthority": null,
                "mutable": false
            },
            "subjectLocality": null,
            "authnInstant": 1758805814000,
            "sessionIndex": "s2be0bc04c82ddb9e91bdf70f21bf5fc7dda59a301",
            "sessionNotOnOrAfter": null,
            "mutable": false
        }
    ],
    "authzDecisionStatements": [],
    "attributeStatements": [
        {
            "mutable": false,
            "encryptedAttribute": null,
            "attribute": [
                {
                    "name": "mail",
                    "nameFormat": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
                    "friendlyName": null,
                    "mutable": false,
                    "attributeValue": [
                        "<saml:AttributeValue ...xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">bjensen@example.com</saml:AttributeValue>"
                    ],
                    "anyAttribute": null,
                    "attributeValueString": [
                        "bjensen@example.com"
                    ]
                }
            ]
        }
    ],
    "issuer": {
        "value": "idp1",
        "nameQualifier": "",
        "format": "",
        "mutable": false,
        "spnameQualifier": "",
        "spprovidedID": ""
    },
    "signed": true,
    "mutable": false,
    "timeValid": true
}

hostedEntityId

The entity ID for the hosted SP.