# SAML Custom Attributes **URL:** \ **Category:** Get Help\ **Tags:** configuration, application\ **Created:** [September 16, 2025, 4:30pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980 "2025-09-16T16:30:03Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 16, 2025, 4:30pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/1 "2025-09-16T16:30:03Z")
I have followed this post: > **[Customize SAML Assertions](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration/customize-saml-assertions)** > > Describes how to customize SAML assertions and the SAML and WS-Fed protocol parameters. to a very simple implementation. No filtering for an application/client ID, no resolving of existing data and mapping, just trying to hard code a single custom SAML attribute for testing. Action(deployed): > exports.onExecutePostLogin = async (event, api) =\> { > > api.samlResponse.setAttribute(‘[http://example.com/protoTypeName](http://example.com/protoTypeName)’, “protoType1”); > > }; I have a single application using SAML using the saml2 web add-on. I have tried both mapping this value and not mapping the value in the bindings section: > “mappings”: { > “user\_id”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier%E2%80%9D), > “email”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress%E2%80%9D), > “name”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name%E2%80%9D), > “given\_name”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname%E2%80%9D), > “family\_name”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname%E2%80%9D), > “upn”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn%E2%80%9D), > “groups”: “[http://schemas.xmlsoap.org/claims/Group”](http://schemas.xmlsoap.org/claims/Group%E2%80%9D), > “protoTypeName”: “[http://example.com/protoTypeName”](http://example.com/protoTypeName%E2%80%9D) > }, This attribute never shows up in the response attributes. What am I missing? ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 17, 2025, 4:45pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/3 "2025-09-17T16:45:04Z")
Hi @jonathan.hughes Just to make sure, in your scenario, your Auth0 Tenant acts as the IdP for the SAML connection used right? If that is correct, by simply using the code you provided inside a Post-Login Action the custom attribute should be visible. I have tested this out on my end and when I decoded the response via the [SamlTool](https://www.samltool.io/), the attribute was visible: ```auto Attributes http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier auth0|{{user_id}} http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress {{user_email}} http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name {{user.name}} http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname Jack http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname Daniels http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn {{user.email}} http://schemas.auth0.com/identities/default/connection Username-Password-Authentication http://schemas.auth0.com/identities/default/provider auth0 http://schemas.auth0.com/identities/default/isSocial false http://schemas.auth0.com/clientID {{client_id}} http://schemas.auth0.com/created_at 2025-01-08T13:07:22.142Z http://schemas.auth0.com/email_verified true http://schemas.auth0.com/nickname {{user.nickname}} http://schemas.auth0.com/picture {{profilePicture_url}} http://schemas.auth0.com/updated_at 2025-09-17T16:40:55.602Z http://schemas.auth0.com/last_password_reset 2025-02-26T23:29:52.360Z http://schemas.auth0.com/tenant {{IDP_TenantName}} http://schemas.auth0.com/multifactor guardian http://example.com/protoTypeName protoType1 ``` If you have any other questions, let me know! Kind Regards, Nik ---
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 17, 2025, 5:07pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/4 "2025-09-17T17:07:02Z")
Yes, I am using Auth0 as the IdP. I do agree that it should work, but it’s not. My service provider has similar logging where I see all the attributes from the response and there is no difference in that result or that tool, the custom claim just isn’t there. ---
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 17, 2025, 5:12pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/5 "2025-09-17T17:12:24Z")
@nik.baleca Were you using the SAML2 Web App add on during your test or some other setup? If so, did you use this value in the mappings section or not? Looking to find any difference in what you tested vs what i’m doing. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 17, 2025, 5:32pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/6 "2025-09-17T17:32:18Z")
Yes, I am using the SAML2 Web App Addon. I have not changed any mappings in the addon’s setting page, I have only added the same code as you did in the Post-Login Action: ```auto exports.onExecutePostLogin = async (event, api) => { api.samlResponse.setAttribute("http://example.com/protoTypeName", "protoType1"); }; ``` Just to be sure, are you able to preview the SAML Attributes during the login process on the SP’s side or are you expecting for the attribute to be displayed on the returned user profile? By any chance, have you tried to retrieve the SAML Response from the browser’s Network Activity and decode it using the provided website? Kind Regards, Nik ---
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 17, 2025, 6:29pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/7 "2025-09-17T18:29:10Z")
I am only expecting these to show up in the response, not the user profile. I can extract the response from the service provider logs or web traffic both are identical and missing this attribute. I am using just the default configuration with updated URL’s from the add on example. Is there something here that could be causing a difference in behavior than your experience? > { > “audience”: “[https://127.0.0.1:8443/saml/”](https://127.0.0.1:8443/saml/%E2%80%9D), > “recipient”: “[https://127.0.0.1:8443/saml/assertionConsumerService”](https://127.0.0.1:8443/saml/assertionConsumerService%E2%80%9D), > “mappings”: { > “user\_id”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier%E2%80%9D), > “email”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress%E2%80%9D), > “name”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name%E2%80%9D), > “given\_name”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname%E2%80%9D), > “family\_name”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname%E2%80%9D), > “upn”: “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn%E2%80%9D), > “groups”: “[http://schemas.xmlsoap.org/claims/Group”](http://schemas.xmlsoap.org/claims/Group%E2%80%9D) > }, > “createUpnClaim”: true, > “passthroughClaimsWithNoMapping”: true, > “mapUnknownClaimsAsIs”: false, > “mapIdentities”: true, > “signatureAlgorithm”: “rsa-sha256”, > “digestAlgorithm”: “sha256”, > “destination”: “[https://127.0.0.1:8443/saml/assertionConsumerService”](https://127.0.0.1:8443/saml/assertionConsumerService%E2%80%9D), > “lifetimeInSeconds”: 3600, > “signResponse”: false, > “typedAttributes”: true, > “includeAttributeNameFormat”: true, > “nameIdentifierFormat”: “urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified”, > “nameIdentifierProbes”: [ > “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier%E2%80%9D), > “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress%E2%80%9D), > “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name”](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name%E2%80%9D) > ], > “authnContextClassRef”: “urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified”, > “binding”: “urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST” > } ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 17, 2025, 7:27pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/8 "2025-09-17T19:27:59Z")
Hi again, Inside the SAML2 Addon, can you try mapping this flag and let me know if there are any differences? ```auto "mapUnknownClaimsAsIs": true ``` Kind Regards, Nik ---
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 17, 2025, 10:05pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/9 "2025-09-17T22:05:39Z")
Unfortunately no change. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 18, 2025, 3:07pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/10 "2025-09-18T15:07:11Z")
By any chance, even if the custom attribute is not forwarded in the SAML Response, is it by any chance available in the user’s RAW JSON under User Management → Users → Select SAML User → RAW JSON? Kind Regards, Nik ---
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 18, 2025, 3:15pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/11 "2025-09-18T15:15:57Z")
No, the attribute is not in the RAW JSON. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 18, 2025, 3:26pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/12 "2025-09-18T15:26:01Z")
Could you send me a DM with the tenant name so I can go ahead and check out the configuration myself? Kind Regards, Nik ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [September 22, 2025, 3:40pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/13 "2025-09-22T15:40:58Z")
Hi again! As far as I have checked on the tenant, the configuration of the SAML Addon looks fine, however, the only issues that I noticed are: - The action in which you add the attribute does not appear to be bound, I can see that it has been deployed but not bound to any trigger. - In similar fashion, checking your logs for any login using the SAML connection, the successful logins do not have any Action Executions logs. Whenever a successful login is performed and there is an action which triggers, you should have different tabs: **RAW Data/Context Data/Actions Executions** Could you let me know that you have bounded the action and are still unable to see the attribute? Otherwise, once you have performed another login using the SAML connection, I will check the tenant again and the logs. Kind Regards, Nik ---
**Author:** ![jonathan.hughes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jonathan.hughes/32/59823_2.png) [@jonathan.hughes](https://community.auth0.com/u/jonathan.hughes)\ **Post date:** [September 22, 2025, 5:31pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/14 "2025-09-22T17:31:53Z")
Thank you for the pointer. I thought I had already created the trigger when I made the action but apparently I didn’t. The action is now running and I am seeing the attribute. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [October 6, 2025, 5:32pm UTC](https://community.auth0.com/t/saml-custom-attributes/191980/15 "2025-10-06T17:32:07Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.