Assigning Zammad Roles Based on Keycloak SAML Roles

simone1 · October 22, 2024, 10:52am

We have successfully integrated Zammad with Keycloak using SAML for authentication. We would like to automatically assign specific roles in Zammad to new users based on their roles in Keycloak when they log in for the first time.

Is this functionality supported in Zammad, and if so, could you please guide us on how to configure this?

Thank you in advance for your help!

fliebe92 · October 22, 2024, 7:13pm

Hi @simone1.

https://admin-docs.zammad.org/en/latest/settings/security/third-party/saml.html#set-up-user-attribute-mapping

Nothing else is implemented right now.

dominikklein · October 22, 2024, 9:11pm

github.com/zammad/zammad

User attributes mapping and role mapping with third-party authorization (e.g. SAML)

opened 02:35PM - 22 Nov 23 UTC

dominikklein

enhancement SAML third-party authorization

### What The user attributes are only mapped once (and only special attribute…s) during the usage of the third-party authorization. Because of that, it's for example currently not possible to use only an SAML authorization when you want to have the user attributes up to date (and also sync more than the "simple" defined attributes) without an additional LDAP sync in place. Also, it's not possible to sync any role assignment. ### Use cases As a company, I want to have one central place for all my user handling without the need to connect one part for authentication and one part for a general user sync. ### Intended Outcome The user attributes should be synced during every third-party login (the "external source" should be the central data point). Also, it should be possible to handle a role and group mapping (currently this will only be related to SAML). With this, it should be possible in the future to use SAML without the need for an LDAP sync (=this means not it's no longer allowed/possible when it's still needed). #### Restrictions - No creation of new roles - No creation of new groups ### Technical implementation For every third-party authorization, we should implement the needed mapping for the known attributes. Especially for SAML, it should be possible to sync every attribute when the mapping on the IDP side provides the attribute in the "needed" way. In the SAML context also roles should be mapped. For this, the given role needs already be present inside the Zammad system. **In the current user attribute mapping the usage of the "nickname" attribute should be removed, because it's no valid uid for the login.**