Dynamic claims now support SAML assertions
Dynamic claims can now read values from a SAML 2.0 response, so a Credential Provider can issue a credential bound to each SAML user’s own identity.
Aembit receives SAML responses when users sign in through the MCP Authorization Server or the MCP Identity Gateway. A SAMLv2 Response Trust Provider validates each response, and three expressions read values from its assertion:
${saml.response.subject.nameId}returns the Subject NameID that identifies the user.${saml.response.issuer}returns the identity provider that issued the assertion.${saml.response.attributes['<name>']}returns a named attribute, such as a user’s groups.
If a SAML expression can’t resolve to a value, Aembit denies the request and issues no credential. The Credential Provider form in the Aembit Tenant UI shows the SAML syntax with examples. See SAML assertion claims.