Specify the location of the Groovy class which maps SAML users to their permissions.

Key: auth.admin.saml.groovy-permission-mapper
Type: File
Can be set in: global.cfg

Table of Contents


Sets the path to a groovy script implementing a mapping from SAML credentials provided by the identify provider to objects representing Funnelback Users.

The following example script provides a simple example in which the groovy script simply loads the 'admin.ini' file for all valid SAML users. In practice a script would likely interrogate the given SAMLCredential, and load or create a suitable user object which grants permissions appropriate for the user. References to testclient in the example should be updated to a valid client ID and the roles updated to appropriate roles that exist on the Funnelback server.

import java.util.Arrays;



public class ExampleGroovySamlFunnelbackUserMapper implements SamlFunnelbackUserMapper {
    public SAMLConfiguredUser getSAMLDerivedUser(SAMLCredential credential, SAMLConfiguredUser emptyUser, File searchHome)
        throws UsernameNotFoundException {
        String username = "testclient~foo"; // Derive this from the SAMLCredential
        return emptyUser.withUserInfoDetails(emptyUser.getUserInfoDetails()
                        // These roles should be mapped to ones that exist on disk, depending on
                        // attributes that are provided by the SAMLCredential.
                            new RoleId("testclient~default-super-user"),
                            new RoleId("testclient~primary"),
                            new RoleId("testclient~resources")

The file containing the script can be located anywhere so long as it is readable by the Funnelback jetty web server. Further detail about the provided SAMLCredential object is available within the spring security SAML documentation.

⚠ Caveats

This setting requires Jetty to be restarted to take effect.