mapping SAML2 claims => django auth groups

[luzik]

How can I achieve an need of mapping AD groups/rules into builtin django groups ? For example if user is in ActiveDirectory "user_can_edit_web" group I can make an transformation this group membership into SAML "role" claim.

Should it be done in AbstractUser subclass ? or maybe as PullRequests to this project ?

Configuration could be something like that:

'ATTRIBUTES_MAP': { # Change Email/UserName/FirstName/LastName to corresponding SAML2 userprofile attributes. 'email': 'Email', 'username': 'UserName', 'first_name': 'FirstName', 'last_name': 'LastName', '_group_map': { 'django_group_can_edit_web': ('role', 'user_can_edit_web') }, },

[luzik]

Or maybe I can access logged user object in 'BEFORE_LOGIN' trigger ? and change it there ?

[jonwhittlestone]

+1

You can use the BEFORE_LOGIN hook but then you'd like to persist the IDP groups to the session somehow ...

[josegonzalez]

See https://github.com/fangli/django-saml2-auth/pull/102 for an example...