Setting Up Binding between User Attributes and Provider Attributes

For example, the user is authenticated in the external service and is authorized in Foresight Analytics Platform, a temporary user is created in the security manager and is added to groups from the list of attribute specified in userinfo. If the attribute is not set, the temporary user is added to the USERS built-in group. After this, user attributes values are filled in according to configured provider attribute bindings. When a repository object is being opened, the set of attribute-based access control policies, in which user attributes are used, is checked. If the specified conditions are satisfied, the user is allowed access to the object.

Setting up of bindings between user attributes and provider attributes is available for the users with the Changing User Permissions, Distributing Roles, Changing Policy and the Security Policy Auditing privileges.

To set up bindings between user attributes and provider attributes, use the Provider Attribute Binding dialog box.

Go to the Users section.
Select the Set Up Bindings item in the drop-down menu of the Attributes button in the toolbar.

NOTE. The item is available if the Attributes dialog box contains as least one user attribute.

The dialog box displays the list of added bindings between user attributes and provider attributes.

To add an attribute binding:

Click the Add button. After executing the operation the Add Binding dialog box opens:

Set the parameters:

Attribute. Select the user string attribute in the drop-down list. The list of attributes is created in the Attributes dialog box.
Provider. Select provider in the drop-down list:

LDAP. Get attribute values of LDAP directory.
OIDC. Get attribute values of OAuth 2.0 or OpenID Connect external service.
ExtService. Get attribute values of JWT token or HTTP headers.

Domain. Select a specific user domain in the drop-down list. The list of domains is generated in the MultiDomain section in the settings.xml file. To bind the attribute to all domains, use the All Domains value. The selected user domain is displayed via a colon in the Provider column. If the attribute is bound to all domains, the provider is displayed as follows: LDAP:*.

NOTE. The parameter is available if the LDAP option is selected in the Provider parameter.

Provider Attribute. Enter provider attribute name in upper case, which value will be sent to the attribute selected in the Attribute parameter.

Click the OK button.

After executing the operations the attribute binding is added. If the specified binding parameters Attribute, Provider, Domain match the parameters of the existing binding, the corresponding message is displayed requesting prompting to replace the existing binding.

To edit attribute binding:

Select the attribute in the list.
Click the Edit button. After executing the operation the Edit Binding dialog box opens:

Change the value of the Provider Attribute parameter.
Click the OK button.

After executing the operations the provider attribute bound with the user attribute will be changed.

To delete attribute binding:

Select one or several attributes in the list while holding down the CTRL or SHIFT key.
Click the Delete button.

After executing the operations a confirmation dialog box opens. If the answer is positive, the attribute binding will be deleted.

Features of Sending Provider Attribute Values

There are the following features of sending provider attribute values during user authorization: