Linking by using the SAML protocol

Ops Center Installation and Configuration Guide
Version
11.0.x
Audience
anonymous
Part Number
MK-99OPS001-25
To synchronize email addresses, last names, and first names of users of an identity provider other than AD FS with those of Common Services, you must specify mappings between assertion attributes for the identity provider and Keycloak user attributes. You can choose which attributes to map for users.

Configure the assertion attributes for the identity provider. The assertion sent from the identity provider must include attributes required for Keycloak user attributes. For details on assertion attribute settings for the identity provider, see the documentation for the identity provider that you are using.

The following table below provides the correspondence between Keycloak user attributes and assertion attributes for an identity provider.

Keycloak user attribute Example of assertion attributes for an identity provider
email http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
lastName http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
firstName http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
  1. Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who belongs to the opscenter-administrators group.
  2. From the navigation bar, click Manage users.
  3. In the Users window, from the Asset type, click Identity providers (Other).
  4. In the Identity providers (Other) window, click Embedded Keycloak.
  5. Log in to Keycloak as the idpadmin user.
  6. In the Identity providers window, click the registered identity provider.
  7. In the Provider details window, click the Mappers tab.
  8. For each attribute to be synchronized, specify the item required for mapping.
    1. Click Add mapper.
    2. In the Add Identity Provider Mapper window, specify the following items.
      • When specifying an email address:
        Item Value to be specified Example of value to be specified
        Name Any Name email-mapper
        Sync mode override Value that can be selected from the list Force
        Mapper type Attribute Importer Attribute Importer
        Attribute Name Assertion attribute for the identity provider http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
        Name Format ATTRIBUTE_FORMAT_BASIC ATTRIBUTE_FORMAT_BASIC
        User Attribute Name email email
      • When specifying a last name:
        Item Value to be specified Example of value to be specified
        Name Any Name lastName-mapper
        Sync mode override Value that can be selected from the list Force
        Mapper type Attribute Importer Attribute Importer
        Attribute Name Assertion attribute for the identity provider http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
        Name Format ATTRIBUTE_FORMAT_BASIC ATTRIBUTE_FORMAT_BASIC
        User Attribute Name lastName lastName
      • When specifying a first name:
        Item Value to be specified Example of value to be specified
        Name Any Name firstName-mapper
        Sync mode override Value that can be selected from the list Force
        Mapper type Attribute Importer Attribute Importer
        Attribute Name Assertion attribute for the identity provider http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
        Name Format ATTRIBUTE_FORMAT_BASIC ATTRIBUTE_FORMAT_BASIC
        User Attribute Name firstName firstName
    3. After configuration is complete, click Save.
    4. Repeat this procedure until all the attributes to be synchronized are specified.