Introduction

Auth0 provides the Actions feature, which enables custom logic in authentication and authorization. In August 2023, the following three feature updates were made:

• SAML response customization for logged-in users
• Scope customization in access tokens
• Expanding available user information

This page describes how to customize SAML responses for logged-in users.
For information on customizing the scope of access tokens, see Customizing Access Tokens with Auth0 Actions.

Feature update overview

The updated features are as follows.

• SAML response customization for logged-in users
  The ability to customize SAML responses regarding logged-in users has been added as an API Object for Login Flow. You can add any attributes to the SAML response, specify the NameID format, customize the SAML token expiration date, etc. For the added API Object (api.samlResponse), please check Actions Triggers: post-login - API Object - Auth0 docs.
  Please note that there are limitations to SAML response customization using the Actions function. For more information, please see Actions Limitations - Auth0 docs.

Setting and operation example

This section describes how to customize SAML responses for logged-in users using the Actions function, as well as examples of how to set up and operate the function.

Configuration example: Customizing SAML attributes

In SAML authentication using Auth0 (Splunk Cloud), we introduced customizing SAML responses using the Rules function. This time, we will implement similar processing using the Actions function.

• On the Auth0 management screen, click [Actions] > [Library]
  
• Click [Create Action] > [Build from scratch].
  
• Select the name of the action to be created, the trigger of the action, and the execution environment, and click [Create].
  

4. Write the logic to be realized in the code editor (JavaScript description)

*Only the minimum necessary processing is listed.

exports.onExecutePostLogin = async (event, api) => {
	if (event.authorization) {
		api.samlResponse.setAttribute('http://schemas.auth0.com/rolez', event.authorization.roles)
	}
};

5. Click [Deploy] and confirm that it was saved successfully.

6. In the Auth0 dashboard, click [Actions] > [Triggers].

7. Select [post-login] as the Trigger to incorporate the created Action.

8. Drag and drop the target action from the list of actions displayed on the Custom tab on the right side of the screen and place it on the flow diagram on the left side of the screen.

9. Click [Apply] and confirm that it has been reflected correctly.

(Omitted) <saml:Attribute Name=" http://schemas.auth0.com/rolez" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi: type="xs:string"> admin </saml:AttributeValue> </saml:Attribute> (omitted)

in conclusion

This time, we introduced how to customize SAML responses in the Actions feature update. Since the EOL (End of Life) announcement for the Rules/Hooks feature has been made, it is expected that more processes that can be implemented with the Actions feature will continue to be added in the future.

We will continue to update the information as updates are implemented.