Set Custom NameIdentifier Attribute in SAML Response from Auth0

Knowledge Articles
1

Overview

When Auth0 generates a SAML response at the end of the login when Auth0 is acting as the SAML Identity Provider (IdP), it uses the user’s user_id or email as the NameID in the subject. This article explains how to update this to a custom value using a Post-Login Action.

Applies To

Solution

To set an attribute in the user’s app_metadata as the NameID (app_metadata.unique_email), for example, as the NameIdentifier, look at the following code in a Post-Login Action:

exports.onExecutePostLogin = async (event, api) => {
  api.samlResponse.setAttribute('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier', event.user.app_metadata.company_email);

  api.samlResponse.setNameIdentifierProbes([
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'
  ]);
}

If the value does not exist in app_metadata, it will fall back to the user’s email. It is also possible to specify a fallback when calling the setAttribute() function above.