Skip to content

Commit c913375

Browse files
ranbelranbel
committed
add more JSONata examples
1 parent 3d86a40 commit c913375

File tree

1 file changed

+187
-29
lines changed

1 file changed

+187
-29
lines changed

‎src/content/docs/cloudflare-one/applications/configure-apps/saas-apps/generic-saml-saas.mdx‎

Lines changed: 187 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 1
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, Details } from "~/components";
99

1010
This page provides generic instructions for setting up a SaaS application in Cloudflare Access using the SAML authentication protocol.
1111

@@ -86,7 +86,7 @@ Open an incognito browser window and go to the SaaS application's login URL. You
8686
- `email` - User's email address
8787
- `groups` - Identity provider group membership
8888

89-
In Access for SaaS, you can add additional SAML attributes and customize the SAML statement sent to the SaaS application. This allows you to integrate SaaS applications which have specific SAML attribute requirements.
89+
In Access for SaaS, you can add additional SAML attributes or customize the SAML statement sent to the SaaS application. This allows you to integrate SaaS applications which have specific SAML attribute requirements.
9090

9191
### SAML attribute statements
9292

@@ -102,37 +102,23 @@ To send additional SAML attributes to your SaaS application, configure the follo
102102
- **Required**: If a claim is marked as required but is not provided by an IdP, Cloudflare will fail the authentication request and show an error page.
103103
- **Add per IdP claim**: (Optional) If you turned on multiple identity providers for the SaaS application, you can choose different attribute mappings for each IdP. These values will override the parent **IdP claim**.
104104

105-
### Transformation
105+
### JSONata transforms
106106

107-
In **Advanced settings** > **Transformation**, you can enter a [JSONata](https://jsonata.org/) script that modifies a copy of the user identity before creating SAML attributes to be sent to the SaaS application. This is useful for setting defaults, excluding email addresses, or ensuring usernames meet arbitrary criteria.
107+
In **Advanced settings** > **Transformation**, you can enter a [JSONata](https://jsonata.org/) script that modifies a copy of the [User Registry identity](/cloudflare-one/insights/logs/users/). This is useful for setting default values, excluding email addresses, or ensuring usernames meet arbitrary criteria. Access will send the modified user identity to the SaaS application as SAML attributes.
108108

109-
Note that JSONata Transformations are not compatible with SAML attribute statements. JSONata transformations will override any specified SAML attributes.
109+
:::note
110+
JSONata transformations are not compatible with [SAML attribute statements](#saml-attribute-statements). JSONata transformations will override any specified SAML attributes.
111+
:::
110112

111-
For example, the following JSONata script modifies the `groups` attribute:
113+
For example, the following JSONata script merges group names into a list and adds an `eduPersonPrincipalName` field which maps to the user email.
112114

113-
```jsonata title="JSONata expression"
114-
{
115-
"account_id": account_id,
116-
"amr": amr,
117-
"auth_status": auth_status,
118-
"common_name": common_name,
119-
"devicePosture": devicePosture,
120-
"device_id": device_id,
121-
"device_sessions": device_sessions,
122-
"email": email,
123-
"gateway_account_id": gateway_account_id,
124-
"geo": geo,
125-
"groups": $map($.groups, function($group) {
126-
{"group_name": $group.name}}),
127-
"iat": iat,
128-
"id": id,
129-
"idp": idp
130-
}
115+
```jsonata title = "JSONata expression"
116+
$merge([$, {"groups": groups.name, 'eduPersonPrincipalName': email}])
131117
```
132118

133-
Here is an example of a user identity before applying the transform:
119+
Here is an example of a user identity before applying the JSONata transform:
134120

135-
```json title= "Before JSONata transform" collapse={2-25, 40-45}
121+
```json title= "User identity before JSONata transform"
136122
{
137123
"account_id": "699d98642c564d2e855e9661899b7252",
138124
"amr": [
@@ -181,9 +167,123 @@ Here is an example of a user identity before applying the transform:
181167
}
182168
```
183169

184-
Here is the payload after applying the example JSONata transform:
170+
Result after applying the example JSONata script:
171+
172+
```json output
173+
{
174+
"account_id": "699d98642c564d2e855e9661899b7252",
175+
"amr": [
176+
"pwd"
177+
],
178+
"auth_status": "NONE",
179+
"common_name": "",
180+
"device_id": "c1744f8b-faa1-48a4-9e5c-02ac921467fa",
181+
"device_sessions": {
182+
"49e653db-991e-11ee-af26-2243bf8c3428": {
183+
"last_authenticated": 1703004275
184+
}
185+
},
186+
"devicePosture": {
187+
"8534a230-e85e-4183-8964-a4b7dcf72986": {
188+
"rule_name": "Warp",
189+
"success": true,
190+
"type": "warp"
191+
}
192+
},
193+
"email": "[email protected]",
194+
"gateway_account_id": "bTSquyUGwLQjYJn8cI8S1h6M6wU",
195+
"geo": {
196+
"country": "US"
197+
},
198+
"groups": [
199+
"IdentityProtection-RiskyUser-RiskLevel-low",
200+
"Global Administrator",
201+
"Application Administrator"
202+
],
203+
"iat": 1659474397,
204+
"id": "OidHvkPt-I-13IBSnd77UJ8cHgsrUpjs3W6_4t6ES7M",
205+
"idp": {
206+
"id": "b08e8c0c-a75d-4b3f-8e7b-cd427b7c7b47",
207+
"type": "azureAD"
208+
},
209+
"eduPersonPrincipalName": "[email protected]"
210+
}
211+
```
212+
213+
For more JSONata transform use cases, refer to the following examples.
214+
215+
<Details header="Remove groups attribute">
216+
217+
The following JSONata script removes the `groups` SAML attribute. This can be useful if your SaaS application does not need to receive user group information.
218+
219+
```jsonata title="JSONata expression"
220+
$ ~> |$|{}, ['groups']|
221+
```
222+
223+
Result after applying the JSONata transform:
224+
```json output
225+
{
226+
"account_id": "699d98642c564d2e855e9661899b7252",
227+
"amr": [
228+
"pwd"
229+
],
230+
"auth_status": "NONE",
231+
"common_name": "",
232+
"device_id": "c1744f8b-faa1-48a4-9e5c-02ac921467fa",
233+
"device_sessions": {
234+
"49e653db-991e-11ee-af26-2243bf8c3428": {
235+
"last_authenticated": 1703004275
236+
}
237+
},
238+
"devicePosture": {
239+
"8534a230-e85e-4183-8964-a4b7dcf72986": {
240+
"rule_name": "Warp",
241+
"success": true,
242+
"type": "warp"
243+
}
244+
},
245+
"email": "[email protected]",
246+
"gateway_account_id": "bTSquyUGwLQjYJn8cI8S1h6M6wU",
247+
"geo": {
248+
"country": "US"
249+
},
250+
"iat": 1659474397,
251+
"id": "OidHvkPt-I-13IBSnd77UJ8cHgsrUpjs3W6_4t6ES7M",
252+
"idp": {
253+
"id": "b08e8c0c-a75d-4b3f-8e7b-cd427b7c7b47",
254+
"type": "azureAD"
255+
}
256+
}
257+
```
258+
</Details>
259+
260+
<Details header="Rename groups field and remove group ID">
185261

186-
```json title="After JSONata transform" collapse={2-25, 40-45}
262+
The following JSONata script changes the `groups.name` field from `name` to `group_name` and removes the `groups.id` field:
263+
264+
```jsonata title="JSONata expression"
265+
{
266+
"account_id": account_id,
267+
"amr": amr,
268+
"auth_status": auth_status,
269+
"common_name": common_name,
270+
"devicePosture": devicePosture,
271+
"device_id": device_id,
272+
"device_sessions": device_sessions,
273+
"email": email,
274+
"gateway_account_id": gateway_account_id,
275+
"geo": geo,
276+
"groups": $map($.groups, function($group) {
277+
{"group_name": $group.name}}),
278+
"iat": iat,
279+
"id": id,
280+
"idp": idp
281+
}
282+
```
283+
284+
Result after applying the JSONata transform:
285+
286+
```json output
187287
{
188288
"account_id": "699d98642c564d2e855e9661899b7252",
189289
"amr": [
@@ -229,4 +329,62 @@ Here is the payload after applying the example JSONata transform:
229329
}
230330
```
231331

232-
In this example, the JSONata transform changed the `group.name` field from `name` to `group_name` and removed the `group.id` field.
332+
</Details>
333+
334+
<Details header="Filter groups by name">
335+
336+
The following JSONata script filters groups to those that match a regular expression.
337+
338+
```jsonata title="JSONata expression"
339+
$merge([$, { "groups": $filter(groups, function($v) { $contains($v.name, /Administrator/) }) }])
340+
```
341+
342+
Result after applying the JSONata transform:
343+
344+
```json output
345+
{
346+
"account_id": "699d98642c564d2e855e9661899b7252",
347+
"amr": [
348+
"pwd"
349+
],
350+
"auth_status": "NONE",
351+
"common_name": "",
352+
"device_id": "c1744f8b-faa1-48a4-9e5c-02ac921467fa",
353+
"device_sessions": {
354+
"49e653db-991e-11ee-af26-2243bf8c3428": {
355+
"last_authenticated": 1703004275
356+
}
357+
},
358+
"devicePosture": {
359+
"8534a230-e85e-4183-8964-a4b7dcf72986": {
360+
"rule_name": "Warp",
361+
"success": true,
362+
"type": "warp"
363+
}
364+
},
365+
"email": "[email protected]",
366+
"gateway_account_id": "bTSquyUGwLQjYJn8cI8S1h6M6wU",
367+
"geo": {
368+
"country": "US"
369+
},
370+
"groups": [
371+
{
372+
"id": "12348f47-8234-4860-a03f-c2a1513f267b",
373+
"name": "Global Administrator"
374+
},
375+
{
376+
"id": "11235980-87d7-4917-b0aa-74c01914c40e",
377+
"name": "Application Administrator"
378+
}
379+
],
380+
"iat": 1659474397,
381+
"id": "OidHvkPt-I-13IBSnd77UJ8cHgsrUpjs3W6_4t6ES7M",
382+
"idp": {
383+
"id": "b08e8c0c-a75d-4b3f-8e7b-cd427b7c7b47",
384+
"type": "azureAD"
385+
}
386+
}
387+
```
388+
</Details>
389+
390+

0 commit comments

Comments
 (0)