Add SAML Attributes
Use the SSO / Add SAML Attributes action to add custom attributes to the SAML assertion Descope issues when acting as a SAML Identity Provider. Use it for attributes that User Attribute Mapping and Group Mapping don't cover — for example, attributes computed during the flow, or attributes received from a tenant's own SSO provider.
Add the Action
- Open the flow attached to your SAML federated application.
- Click the (+) icon, search for SSO / Add SAML Attributes, and add it before the flow ends.
- You can rename the step (defaults to SAML Additional Attributes).
Configure the Action
Attributes
Add one row per attribute you want in the assertion:
| Key | Type | Value |
|---|---|---|
department | String | Engineering |
Key is the SAML attribute name. Type determines how Descope reads Value:
| Type | Description |
|---|---|
| String / Boolean / Number / Time | A static value of that type. |
| Dynamic | A value read from flow context at runtime — for example a value resolved from a connector or a Scriptlet earlier in the flow. |
| List | Multiple values for a single multi-valued SAML attribute. |
Context Key for SAML Attribute Map (Optional)
Instead of (or in addition to) the rows above, point this at a flow context key holding a map of attribute names to values — for example a map returned by a connector or scriptlet. Descope adds every entry in that map to the assertion.
Note
This must resolve to an actual object, not a JSON string. In particular, a verified Verify Token token's claims live on the flow's customClaims context value as a JSON-encoded string. Parse it into an object with a Scriptlet and store the result under its own context key before pointing this field at it.
Add attributes from incoming SAML assertion
Turn this on if the user signed in through the tenant's own SSO provider (a SAML identity provider), and you want to pass those same attributes through to the SP you're issuing this assertion to.
Note
Run the flow and check flow context in the Flow Runner to confirm what's stored under your chosen context key before relying on it here.