If your organization uses SAML single sign-on (SSO) for authentication and authorization, use the Orgs resource to map SAML roles and groups to IDMC roles. You can also use the Orgs resource to get details about SAML role and group mappings for an organization.
You can map up to 200 SAML groups or roles to an IDMC role. To find a list of IDMC roles, you can use the Roles resource.
Before you map SAML groups and roles, ensure that the Map SAML Groups and Roles option is enabled in Administrator.
After you map SAML groups and roles to IDMC roles, you cannot configure user roles or groups for SAML SSO users individually in Administrator or through the IDMC REST API.
For more information about using SAML SSO, see User Administration in the Administrator help.
Adding SAML group mappings
Add SAML group mappings that map SAML groups to IDMC roles.
Note: You cannot map a SAML group or role that contains one of the following characters in the name:
•Pipe ( | )
•Semicolon ( ; )
•Comma ( , )
PUT request
To add a mapping between an IDMC role and SAML groups, use the following URI:
If you map a SAML group that doesn't exist in IDMC, IDMC creates the group. If a group with the same name exists in IDMC, you can specify whether to reuse the group or create a new group. By default, IDMC creates a new group with _EXT appended to the name.
Include the following information:
Field
Type
Required
Description
groupMappings
Array
yes
Object that defines the IDMC role and SAML group mappings.
roleName
String
yes
Include in the groupMappings object.
Name of the IDMC role.
samlGroupNames
String
yes
Include in the groupMappings object
Names of the SAML groups to map to the IDMC role.
reuseGroup
Boolean
--
Whether to use the existing IDMC group if the group name is the same as the SAML group name.
If false, IDMC creates a new group.
Default is false.
Returns the 204 response code if successful. Returns an error object if errors occurs.
PUT examples
To map the IDMC Admin role to the Security and Dev-Managers SAML groups, and map the IDMC Designer role to the Developers SAML group, you might send a request similar to the following example:
Object that defines the IDMC role and SAML role mappings.
roleName
String
yes
Include in the roleMappings object.
Name of the IDMC role.
samlRoleNames
List
yes
Include in the roleMappings object
Names of the SAML roles to map to the IDMC role.
Returns the 204 response code if successful. Returns an error object if errors occurs.
PUT example
To map the IDMC Developer role to the Data Designer and MS Deployer SAML roles, and map the IDMC Admin role to the Operator SAML role, you might send a request similar to the following example:
Object that defines the IDMC role and SAML group mappings.
roleName
String
yes
Include in the groupMappings object.
Name of the IDMC role.
samlGroupNames
String
yes
Include in the groupMappings object.
Names of the SAML groups to remove.
PUT example
If you want to remove the mapping between the IDMC Admin role and the Administrators SAML group, you might send a request similar to the following example:
You can get the details for all the group mappings for an organization or use a filter to get group mapping details for a particular IDMC role or SAML group.
GET request
To get details for group mappings, use the following URI:
You can get the details for all the role mappings for an organization or use a filter to get role mapping details for a particular IDMC role or SAML role.
GET request
To get details for role mappings, use the following URI: