Map SAML Attribute to Realm Role

Typically, a user contains a set of roles within the Nintex system:

On the Okta platform, users and roles are managed via OKTA user groups:

We need to instruct Aerobase how to handle user roles being sent from the OKTA within 'Group SAML attributes' as previously described in Adding Group SAML Attributes to OKTA SAML Token. We need to create a map between OKTA user groups and Nintex user roles via an Aerobase identity provider mappers mechanism.

We should define a separate mapper per each group as described below.

To define a separate mapper for each group:

You need to create mapper per each user group.

  1. Access the Aerobase Admin page, using the URL http://[FQDN or IP]/auth/admin/Kryon/console/#/realms/Kryon

  2. Go to Identity Providers (under Configure on the left pane)

  3. Enter your Okta provider and choose the Mappers tab

  4. Click Create

  5. Fill out the details:

    • Name: arbitrary, for example 'SAML Role 1'

    • Mapper Type: choose 'SAML Attribute to Role'

    • Attribute Name: type group SAML attribute name as was configured on OKTA side

    • Friendly Name: leave empty

    • Attribute Value: name of the OKTA group to be mapped to a role

    • Role: select Nintex realm user role to map to

  6. Click Save

As a result you should get the following mappings list - one SAML mapping per OKTA group: