Configuring contract fulfillment for token creation - PingFederate - 10.0

On the Attribute Contract Fulfillment screen, map values to the attributes defined for the contract. These are the values that will be included in the SAML security tokens sent to the SP.

For each attribute, select a source from the list and then choose or enter a value.

• Token

  When selected, the Value list is populated with attributes from the token processor instance. Select the desired attribute from the list. At runtime, the attribute value from the token processor instance is mapped to the value of the attribute in the SAML security token.

  For example, to map the value of the Username Token Processor's username attribute as the value of the TOKEN_SUBJECT attribute on the contract, select Token from the Source list and username from the Value list.

• Context

  When selected, the Value list is populated with the available context of the transaction. Select the desired context from the list. At runtime, the context value is mapped to the value of the attribute in the SAML security token.

  Note:

  The HTTP Request and STS SSL Client Certificate Chain context values are retrieved as Java objects rather than text. For this reason, OGNL expressions are more appropriate to evaluate and return values (see Expression).

  Note:

  When using the STS Basic Authentication Username, STS SSL Client Certificate's Subject DN, or STS SSL Client Certificate Chain contexts, ensure the associated authentication is enabled and configured on the System > Protocol Settings > WS-Trust STS Settings screen.

• Request

  When selected, the Value list is populated with parameter values from the token request received from the web service client. This selection is available only if a request contract was selected earlier on the Request Contract screen. Select the desired context from the list. At runtime, the context value is mapped to the value of the attribute in the SAML security token.

• LDAP, JDBC, or Other

  When selected, the Value list is populated with attributes that you have selected in the attribute source configuration. Select the desired attribute from the list. At runtime, the attribute value from the attribute source is mapped to the value of the attribute in the SAML security token.

• Expression (when enabled)

  This option provides more complex mapping capabilities; for example, transforming incoming values into different formats. Select Expression from the Source list, click Edit under Actions, and compose your OGNL expressions. All variables available for text entries are also available for expressions (see Text).

  Note that expressions are not enabled by default. For more information about enabling and editing OGNL expressions, see Attribute mapping expressions.

• No Mapping

  Select this option to ignore the Value field, causing no value selection to be necessary.

• Text

  When selected, the text you enter is mapped to the value of the attribute in the SSO tokens at runtime. You can mix text with references to any of the values from the authentication source using the ${attribute} syntax.

  You can also enter values from your datastore, when applicable, using this syntax:

  ${ds.attr-source-id.attribute}

  where attr-source-id is the attribute source ID value and attribute is any of the selected attributes in the attribute source configuration.

All attributes must be mapped.