# Dynamic claims now support SAML assertions

Dynamic claims can now read values from a SAML 2.0 response, so a Credential Provider can issue a credential bound to each SAML user’s own identity.

Aembit receives SAML responses when users sign in through the MCP Authorization Server or the MCP Identity Gateway. A SAMLv2 Response Trust Provider validates each response, and three expressions read values from its assertion:

* `${saml.response.subject.nameId}` returns the Subject NameID that identifies the user.
* `${saml.response.issuer}` returns the identity provider that issued the assertion.
* `${saml.response.attributes['<name>']}` returns a named attribute, such as a user’s groups.

If a SAML expression can’t resolve to a value, Aembit denies the request and issues no credential. The Credential Provider form in the Aembit Tenant UI shows the SAML syntax with examples. See [SAML assertion claims](/user-guide/access-policies/credential-providers/advanced-options/dynamic-claims/#saml-assertion-claims).