Skip to main content

OrgChart Help Guide

Azure Active Directory SAML Attribute Mapping

Audience

Audience: Administrators

Overview

SAML Attributes are pieces of information associated with a user. SAML Attributes are sent from a user's Identity Provider, or IDP (i.e Azure AD), to the application they are trying to access (i.e. OrgChart) in the form of a SAML Attribute Assertion.

Admins can choose what SAML Attributes to send in the SAML Attribute Assertion. Some attributes are required for a user to login. However, some attributes are optional, and can be used to do the following:

  • Automatically assign OrgChart Access Groups based on a SAML Attribute value

  • Automatically update user information in the OrgChart User Info panel using information stored in your IDP.

The following article provides step-by-step instructions for configuring your Azure Active Directory SSO Integration to send additional SAML Attributes for Access Group mapping, and User Info panel updates.

Important

Before you begin, ensure that you have a functioning Azure Active Directory SSO integration, as well as at least the following Azure AD permissions:

  • Application Administrator

  • Cloud Application Administrator

  • Privileged Role Administrator

For information on setting up an Azure Active Directory SSO integration, please reference the Azure Active Directory SSO article.

Map Access Groups with an Azure AD Group Claim

Administrators can send a Group Claim in their SAML Attribute Assertion, in order to map users to Access Groups in OrgChart using:

  • Azure AD Security Groups

  • Azure AD Directory Roles (tenant-specific, not app specific)

Add a Group Claim to the SAML Assertion

  1. Open the OrgChart SSO Application in Azure AD.

  2. Click on the Single-Sign On option in the left side panel.

  3. Scroll to the second section (Attributes and Claims), and then click on Edit.

    Azure_AD_Group_Mapping_Edit_Attirbutes_and_Claims.png

  4. Click on the + Add a Group Claim button, and then select which groups associated with the user should be sent in the SAML Attribute Assertion. For our purposes, select one of the following available options:

    • Security Groups - All security groups the the user is a member of.

    • Groups Assigned to the Application -Security groups assigned to the application that the user is a member of.

      Note

      Select this option only if you've assigned users to this application using security groups.

    Azure_AD_Add_Group_Claim.png

  5. Click on the Source Attribute dropdown menu, and then select the Group ID option.

  6. Click on Save.

Find the Claim Name and IDs for the Attribute

  1. Copy the Claim Name for the additional claim (added in steps 1-6 above), and then paste it in a separate document. You will need this information later.

    Azure_AD_Copy_Group_Claim_Name.png

  2. Return to the Overview page of your Azure AD workspace.

  3. Click on the Groups option in the left hand panel, and then search for each Group that you plan to map in OrgChart. Remember that these Groups must be Groups that will be sent in the SAML Assertion according to the Group Claim configuration completed in step 4.

  4. Copy the Object ID for each Group that you plan to map in OrgChart, and then paste these IDs in a separate document. Ensure that you track which Object IDs are associated with each Group.

    Azure_AD_Copy_Group_Object_ID.png
Map the Groups in OrgChart

Login to OrgChart and follow these steps to complete your setup:

  1. Click on the Mode Switcher icon in the Top Toolbar, and then select the Setup option. The Setup panel is displayed.

    Setup_Account_Settings_Select.png

  2. Click on the Account Settings tile, and then click on the Authorization tab in the left side menu.

    5_3_1_Account_Settings_Authorization.png

  3. Mouse over your SSO Configuration, and then click on the 5_2_1_BlueGear_nofill.png icon.

  4. Copy the Claim Name (retrieved in step 1 of the section above), and then paste it into the SAML Group Attribute text box.

  5. Click on the 5_2_Plus_NotWide.png icon (to the right of the SAML Attributes Handling header), and then paste a Group Object ID (retrieved in step 4 of the section above) in the SAML Attribute for Group text box.

  6. Click on the Application Security Group dropdown menu, and then select the OrgChart Access Group that should be assigned to users associated with that Group Object ID.

    Azure_AD_Security_Group_Mapping_in_OCN.png

  7. Repeat steps 5-6 until all the desired Azure AD Security Groups are mapped to OCN Access Groups.

  8. Click on Save.

Map Access Groups with Azure AD App Roles

Administrators can map Access Groups using Azure AD app roles, which are application specific.

This option is preferrable for people who still want to use automatic Access Group assignment when:

  • Tenant wide security groups do not directly correlate with the desired group mapping

AND/OR

  • Modifying or adding additional tenant wide security groups is not possible.

Add App Roles

  1. Open the OrgChart SSO Application in Azure AD.

  2. Click on the Users and Groups option in the left hand panel.

  3. Click on the Application Registration hyperlink to create app-roles for this application.

    Azure_AD_App_Registration_for_User_Groups.png

  4. Click on the + Create App Role button.

    Azure_AD_Create_app_role.png

  5. Enter a display name (i.e. General Role) in the Display Name text box.

  6. Select the Both (Users/Groups + Applications) radio button.

  7. Enter the value (i.e General) that will appear in the SAML Attribute Assertion for users/groups assigned to this app role. Copy and paste the Role Value in a separate document. You will need this later.

  8. Optionally, enter a description for users or groups assigned to this app role.

  9. Check the Do you want to enable this app role checkbox, and then click on Apply.

  10. Repeat steps 4-9 above for each new app-role you would like to create.

Assign App Roles to Users/Groups

  1. Re-open the OrgChart SSO application, and then click on the Users and Groups option in the left hand panel.

  2. Click on the +Add user/group button, and then begin assigning groups, and the corresponding app roles, to the application. Members of these groups will emit the role value in the SAML Attribute Assertion.

  3. Click on Assign.

  4. Click on the +Add user/group button again, and then assign the individual users, and the corresponding app role, to the application.

    Note

    Individually assigned users will emit their individual app-role assignment in the SAML Attribute Assertion first, even if they belong to one of the groups that was previously assigned.

  5. Click on Assign.

Add the Additional Attribute to the SAML Assertion

  1. Click on the Single Sign-On tab in the left hand menu, and then click to edit the Attributes & Claims.

    Azure_Role_Handl_Edit_Attributes.png

  2. Click on the +Add new claim button.

  3. Enter a name for the claim (i.e. Role).

  4. Click on the Attribute radio button, and then select user.assignedroles from the dropdown menu.

    Azure_AD_Add_Role_Attribute.png

  5. Click on Save.

Map the Roles in OrgChart

Login to OrgChart and follow these steps to complete your setup:

  1. Click on the Mode Switcher icon in the Top Toolbar, and then select the Setup option. The Setup panel is displayed.

    Setup_Account_Settings_Select.png

  2. Click on the Account Settings tile, and then click on the Authorization tab in the left side menu.

    5_3_1_Account_Settings_Authorization.png

  3. Mouse over your SSO Configuration, and then click on the 5_2_1_BlueGear_nofill.png icon.

  4. Enter the claim name (created in step 3 above) into the SAML Group Attribute text box.

  5. Click on the 5_2_Plus_NotWide.png icon (to the right of the SAML Attributes Handling header), and then enter a Role Value (created in step 7 of the Add App Role section above) in the SAML Attribute for Group text box.

  6. Click on the Application Security Group dropdown menu, and then select the OrgChart Access Group that should be assigned to users associated with that Role Value.

    Azure_AD_Map_Role_Attribues_in_SSO_Config.png

  7. Repeat steps 5-6 until all the desired Azure AD Assigned App Roles are mapped to OCN Access Groups.

  8. Click on Save.

Update User Info with Additional Attributes

Administrators can auto-populate and update a user's User Info panel using additional SAML Attributes in Azure AD.

Add Additional Attributes to the SAML Assertion

Generally name and email are already included in your Azure AD SAML Assertion. If, you don't see the desired attribute listed in the Attributes & Claims section, follow these steps:

  1. Open the OrgChart SSO application in Azure AD.

  2. Click on the Single Sign-On tab in the left hand menu, and then click to edit the Attributes & Claims.

    Azure_Role_Handl_Edit_Attributes.png

  3. Click on the +Add new claim button.

  4. Enter a name for the claim (i.e FullName).

  5. Click on the Attribute radio button, and then select the source attribute you'd like to be emitted with this claim (i.e. user.displayname).

    Azure_AD_add_Name_Claim.png

  6. Click on Save.

Find the Claim Name

In the Attributes & Claims section, locate the claim names associated with the attributes you'd like to use to update name and email in the OrgChart User Information panel. Copy and paste the full claim name into a separate document.

Azure_AD_Highlight_name_and_email_claim_name.png

Map the Attributes in OrgChart

Login to OrgChart and follow these steps to complete your setup:

  1. Click on the Mode Switcher icon in the Top Toolbar, and then select the Setup option. The Setup panel is displayed.

    Setup_Account_Settings_Select.png

  2. Click on the Account Settings tile, and then click on the Authorization tab in the left side menu.

    5_3_1_Account_Settings_Authorization.png

  3. Mouse over your SSO Configuration, and then click on the 5_2_1_BlueGear_nofill.png icon.

  4. Copy and paste the claim name associated with the email SAML Attribute into the SAML Email Attribute text box.

  5. Copy and paste the claim name associated with the Name SAML Attribute into the SAML Name Attribute text box.

    Azure_AD_Update_Name_and_Email_Mapping_SSO_Config.png

  6. Click on Save. When a user signs into OrgChart via SSO, the user information panel is updated automatically.

    See the sample SAML Assertion and the updated user info panel below:

    Azure_AD_Saml_assertion_and_updated_user_info.png