SAML Directory Manager Role Attributes
The SAML Directory Manager provides a way to specify nameId, email, first and last names, and that works fine. Does it honor role claims (e.g., as http://schemas.microsoft.com/ws/2008/06/identity/claims/role or some variation thereof)? We have the problem that users who are auto-provisioned via the SAML directory manager don't have any roles.
Another seemingly related problem is that the profiles of users who are auto-provisioned by the SAML directory manager can't be edited even by an admin on the system (the edit button simply doesn't show up). And, they can't edit themselves because doing so requires entering their password, which by definition they don't have.
In an ideal world,
- we would be able to edit users as an admin, whether or not they were auto-provisioned.
- we would set their "admin" role using #1.
- we would include their group membership as part of the SAML claim (using the role claim or a variation) and have that be in effect for the duration of their session.
- users could edit their own profiles without entering a password (unless changing their password).
But anything would be an improvement over the current situation, where we can't really do much at all with auto-provisioned users. Thanks in advance!