When you enable the SAML user name attribute, the system authenticates the user based on the SAML attribute value in the assertion XML field. The IdP server returns the user name attribute, which may specify the default role provisioned on the appliance, such as appliance.role.monitor, or a product role, such as ex.role.admin.
To use the attribute user name configuration, you must first remove the default name ID setting by using the no aaa authentication saml username nameid command.
Syntax
[no] aaa authentication saml username attribute <username_attribute>
Parameters
no
Stops using the attribute in the assertion XML field to authenticate users.
username_attribute
Attribute for the username.
Example
The following example first removes the user name name ID configuration and then enables the specified SAML user name attribute to be used for authentication:
hostname (config) # no aaa authentication saml username nameid
hostname (config) # aaa authentication saml username attribute appliance.role.monitor
User role
Admin
Command mode
Config
Supported appliances
Central Management System: Release 8.7.1
Network Security: Release 8.3.2
File Protect: Release 8.3.0