I need to transform the group memberships from an external LDAP directory into a SAML attribute within a SAML session using Keycloak. There will be an undefined number of group memberships for each user. The group name will have a tenant ID for Amazon AWS and the defined role for the user within Amazon (eg. AWS-11111111111-Administrator), so I am quite sure that the way has to be to use the JavaScript Mapper in the client configuration and do some substring modification.
- Is there a way to test the Javascript somehow without having to try and error / login and check SAML session?
- how do I get the Groups as String Values from the LDAP User in the Javascript Mapper in Keycloak?
Example for LDAP Groups (Muliple Groups per user)
AWS-11111111111-Administrator
AWS-11111111111-Contributer
SAML Attributes will have to look like:
arn:aws:iam::11111111111:saml-provider/ProviderName,arn:aws:iam::11111111111:role/Administrator
arn:aws:iam::11111111111:saml-provider/ProviderName,arn:aws:iam::11111111111:role/Contributer