Versions Compared

Old Version 8

changes.mady.by.user Olivia Schütt (Unlicensed)

Saved on

compared with

New Version 9

changes.mady.by.user Olivia Schütt (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleCreate Identity Provider (Claim) Mappings

Create Identity Provider (Claim) Mappings

You can configure claim mappings and group mappings for your external Identity Provider. 

Include Page
TERMS:Identity Provider
TERMS:Identity Provider

Prerequisites

Create Mappings

  1. Open Settings > IdP Settings

  2. Add claim mappings

    1. Provide the claim name from your AD which holds the user attributes e.g. company, telephone number. Ensure the correct spelling! 

    2. Map to Picturepark user attributes

  3. Add group mappings

    1. Provide the claim name (issued claims) from your AD which holds your user group assignments e.g. Groups. Ensure the correct spelling!

    2. Define a Fallback user role. The fallback user role of the IdP will only be used if none of the group mappings find a matching role or the default user role is not defined for the Picturepark. This cannot be Super Admins. 

    3. Map Group names from your AD to user roles in Picturepark. 

Note

Without group mappings, your users will be able to login to Picturepark but will have only the default role of your Picturepark assigned (if there is any configured). You cannot add roles to federated users in Picturepark, but only through group mappings. 

Warning

There is a Microsoft limitation for ADFS 2.0 which prevents using Domain Local Groups in a claim. Choose global or universal groups. More details on this limitation: https://social.technet.microsoft.com/wiki/contents/articles/13829.ad-fs-2-0-domain-local-groups-in-a-claim.aspx

Automatic Claim Mappings

The following attributes are mapped automatically in CP (if not overridden by a claim mapping). 

Further information about claims here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims

User attribute

Claim types (first to have a value wins)

Email

email, that will be used as a username in Picturepark (mandatory). 

sub

User identifier of the user within the IdP (mandatory; provided by ADFS in basic configuration).

First name

given_name

Last name

family_name

Language code

  • Default language coming from IDS

  • Default customer language, only acceptable values are en and de. 

locale

After Creating Identity Provider Mappings

  1. Add Identity Provider to users

Expand
titleUpdate Identity Provider

Update Identity Provider

  1. Open Settings > IdP setup

  2. In the list choose your desired Identity Provider

  3. Update the details

    1. You can not update the name. 

  4. Save

Info

Newly created IdP's or changes made to existing ones could take around a minute to take effect.

Effects of Updating Identity Provider

  • The display name will be updated on the login screen. 

  • The type is not yet in use. 

  • The protocol cannot be changed. 

  • If you change the URL your users' login requests will from now on be sent to the new URL. 

  • If you change the client ID your users' login requests will from now on contain the new client ID, so you must ensure to have a working IdP with this client ID available. 

  • Changes to the Client secret have no effect if authorization code flow with PKCE is used, otherwise client secret must match with the application.

  • Changing the sort order will change the sort order of the buttons on the login form, where 0 is the first position.  

...