# Add custom saml attributes to id token **URL:** \ **Category:** Get Help\ **Tags:** auth0\ **Created:** [January 14, 2022, 11:22pm UTC](https://community.auth0.com/t/add-custom-saml-attributes-to-id-token/76461 "2022-01-14T23:22:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kris.macgillivray](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kris.macgillivray/32/33436_2.png) [@kris.macgillivray](https://community.auth0.com/u/kris.macgillivray)\ **Post date:** [January 14, 2022, 11:22pm UTC](https://community.auth0.com/t/add-custom-saml-attributes-to-id-token/76461/1 "2022-01-14T23:22:43Z")
Auth0 is connected to an external IDp using a SAML connection. this connection will return a custom attribute. I am not sure if it should be added to the user properties in Auth0, using the Mappings section of the connector, or if that is the only way to do it I am then trying to add the information from that attribute to the Token using Action–\>Flows api.idToken.setCustomClaim however I don’t seem to be able to add it I can add information from app\_metadata but not from user properties (does not seem to recognize it). Therefore I am not sure how to either add it to the app\_metadata during saml logon or how I can get it from the user properties ---
**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\ **Post date:** [January 17, 2022, 12:16am UTC](https://community.auth0.com/t/add-custom-saml-attributes-to-id-token/76461/2 "2022-01-17T00:16:39Z")
Hi @kris.macgillivray Welcome to the Auth0 Community, it’s really great to have you here 🙂 I take it Auth0 is acting as the service provider in this case given that you have an external IdP. If the IdP is sending you a custom attribute you will certainly need to map it in Authentication \> Enterprise \> SAML connection \> Mappings tab. The left side of the mapping is the user attribute on the SP side, the right side of the mapping is the claim you’re receiving from the IdP. I would probably do a test connection and open the network trace in the browser to locate the SAML response coming in, check the response in [samtool.io](http://samtool.io) to confirm the custom attribute is there and also confirm the spelling etc. You should also see the attribute in the user account, raw json tab. Not all user properties are available under Actions right now, please see this list for event.user [https://auth0.com/docs/customize/actions/triggers/post-user-registration/event-object#:~:text=original%20authentication%20request.-,event.user,-An%20object%20describing](https://auth0.com/docs/customize/actions/triggers/post-user-registration/event-object#:~:text=original%20authentication%20request.-,event.user,-An%20object%20describing) You would need to use Rules for this scenario until Actions reaches feature parity. Example rule to get the groups property into the Id Token would be ```auto function (user, context, callback) { context.idToken['https://mynamespace/groups'] = user.groups; callback(null, user, context); return callback(null, user, context); } ``` Please let me know if you have any further questions on any of this. Regards ---
**Author:** ![steven.deng](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@steven.deng](https://community.auth0.com/u/steven.deng)\ **Post date:** [June 27, 2023, 3:02pm UTC](https://community.auth0.com/t/add-custom-saml-attributes-to-id-token/76461/3 "2023-06-27T15:02:48Z")
@SaqibHussain I have a code like below: exports.onExecutePostLogin = async (event, api) =\> { const namespace = ‘[https://samplenamesapce.ca](https://samplenamesapce.ca)’; if (event.authorization) { api.idToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles); api.idToken.setCustomClaim(`${namespace}/DN`, event.user[‘DN’]); api.accessToken.setCustomClaim(`${namespace}/roles`, event.authorization.roles); } }; The ‘DN’ is a SAML assertion received from the response and mapped to the user’s ‘DN’. I see the value from the user’s account. I want to provide that value to the claim to the client app, however, I couldn’t get it in the Action. Any clue would be appreciated. ![image](https://global.discourse-cdn.com/auth0/original/3X/8/7/871c9ed910df4a76f9677aeab2b3b131af37d591.png) ---
**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\ **Post date:** [June 27, 2023, 4:37pm UTC](https://community.auth0.com/t/add-custom-saml-attributes-to-id-token/76461/4 "2023-06-27T16:37:01Z")
Hi @steven.deng Thanks for getting in touch with Auth0 Community. I note you’re using an Action to access a user’s root property received via SAML. Currently this is not supported “Top-level `event.user` attributes added by an external IdP or custom database script” as per [https://auth0.com/docs/customize/actions/limitations](https://auth0.com/docs/customize/actions/limitations) We expect to fill this gap early next year but until then you can use Rules. P.S. just looking my sample rule above, I think there is a copy paste error as only one callback should be required i.e: ```auto function (user, context, callback) { context.idToken['https://mynamespace/groups'] = user.groups; return callback(null, user, context); } ``` Warm regards. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [July 11, 2023, 4:37pm UTC](https://community.auth0.com/t/add-custom-saml-attributes-to-id-token/76461/5 "2023-07-11T16:37:29Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.