Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a claim; how does it differ from a SAML attribute?
Short answer
A claim is a name-value piece of information about the user carried in an OpenID Connect ID token, in JWTs or in the user info response; e.g. sub (the user's unique identity at the provider), email, name, groups (OpenID Connect Core 1.0 · Standard Claims). Its counterpart in SAML is the attribute in the assertion: the two do the same job, but their formats differ. A claim is carried in JSON and a SAML attribute in XML, and their names vary by provider (in SAML mostly in URI form). In TR7 AGS, this information is mapped to the AGS user fields (such as Username, E-mail, Display Name, Groups) with JSONata expressions in the Custom User Attribute Mapping section of the Authentication Provider form; for most providers, part of this mapping comes automatically. In the JSONata editor, the Identity Claims (OAuth2 / OIDC) context (the combination of the user info response and the verified ID token claims) is used for OAuth2 and OpenID Connect, and the Assertion Attributes (SAML) context for SAML 2.0.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers | The User Attribute Mapping information bar ("… fields are filled in automatically for this provider") | Seeing the fields mapped automatically for the selected type and provider |
| Same form | Custom User Attribute Mapping: AGS attribute ↔ Source attribute (JSONata) | Mapping claims or SAML attributes to the AGS user fields manually |
| Same form (OAuth2, OpenID Connect) | The JSONata context Identity Claims (OAuth2 / OIDC) | Writing expressions on the claims |
| Same form (SAML 2.0) | The JSONata context Assertion Attributes (SAML) | Writing expressions on the SAML attributes |
| AGS-enabled vService → Sessions | The Username, E-mail, Groups and custom user field columns | Seeing the result of the mapping in the session |
Comparison
| Claim | SAML attribute | |
|---|---|---|
| Protocol | OpenID Connect, OAuth 2.0 user info, JWT | SAML 2.0 |
| Carrier | ID token (JWT) or user info JSON response | Assertion (XML) |
| Name example | email, groups | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress |
| TR7 JSONata context | Identity Claims (OAuth2 / OIDC) | Assertion Attributes (SAML) |
Common Misconceptions
- "Claim names are the same at every provider." Names other than the standard claims such as
sub,email,namevary by provider; different names are mapped with Custom User Attribute Mapping. - "Group information always comes." At most providers, the group claim or attribute is enabled separately or requested with a scope (What is an OAuth scope?).
- "Every mapped field has to be a standard AGS field." When a name outside the standard fields is written, this name becomes a custom user field on the vService; names starting with
_are considered hidden fields and do not produce a custom user field.
How it is done in the documentation
