SAML User Rights: Custom Attributes (Advanced)

These are the advanced way of setting up user rights. We recommend using SAML Access Profiles

https://help.aikido.dev/doc/saml-user-rights-access-profiles-recommended/docVaVb0VPy1

This guide provides detailed instructions on how to configure and manage user rights within Aikido using SAML custom attributes. By leveraging attributes such as aikido_role, aikido_data_edit_rights, aikido_can_ignore, aikido_can_snooze, aikido_can_change_severity, aikido_can_manage_teams, and aikido_teams, you can control user permissions and roles from within your identity provider. This approach ensures that users have the same access in Aikido as set up in your identity provider.

aikido_access_profile: More info
When setting up SAML Access Profiles, this is the claim to use.

<saml:Attribute Name="aikido_access_profile">
    <saml:AttributeValue xsi:type="xs:anyType">My Access Profile</saml:AttributeValue>
</saml:Attribute>

aikido_username: You can define the name of the user in Aikido

<saml:Attribute Name="aikido_username">
    <saml:AttributeValue xsi:type="xs:anyType">John Doe</saml:AttributeValue>
</saml:Attribute>

aikido_role: admin, default, team_only

<saml:Attribute Name="aikido_role">
    <saml:AttributeValue xsi:type="xs:anyType">default</saml:AttributeValue>
</saml:Attribute>

aikido_data_edit_rights: standard, read_only

<saml:Attribute Name="aikido_data_edit_rights">
    <saml:AttributeValue xsi:type="xs:anyType">standard</saml:AttributeValue>
</saml:Attribute>

aikido_can_ignore: true, false

<saml:Attribute Name="aikido_can_ignore">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_snooze: true, false

<saml:Attribute Name="aikido_can_snooze">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_change_severity: true, false

<saml:Attribute Name="aikido_can_change_severity">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_teams: true, false

<saml:Attribute Name="aikido_can_manage_teams">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_export_data: true, false

<saml:Attribute Name="aikido_can_export_data">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_clouds: true, false

<saml:Attribute Name="aikido_can_manage_clouds">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_containers: true, false

<saml:Attribute Name="aikido_can_manage_containers">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_domains: true, false

<saml:Attribute Name="aikido_can_manage_domains">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_pentests: true, false

<saml:Attribute Name="aikido_can_manage_pentests">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_code_quality: true, false

<saml:Attribute Name="aikido_can_manage_code_quality">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_can_manage_repos: true, false

<saml:Attribute Name="aikido_can_manage_repos">
    <saml:AttributeValue xsi:type="xs:anyType">true</saml:AttributeValue>
</saml:Attribute>

aikido_teams: You can define the different teams where the user is a part of here. If the team(s) do not exist in Aikido, it will be created. The user will auto-join these given teams. The user will be removed from all other teams if this is set up.
```
<saml:Attribute Name="aikido_teams">
    <saml:AttributeValue xsi:type="xs:anyType">team1</saml:AttributeValue>
    <saml:AttributeValue xsi:type="xs:anyType">team2</saml:AttributeValue>
</saml:Attribute>
```
aikido_workspace_ids: You can define the different Aikido workspaces where the user is a part of here. The user will auto-join these given workspaces. The user will be removed from all other workspaces if this field is set up.
```
<saml:Attribute Name="aikido_workspace_ids">
    <saml:AttributeValue xsi:type="xs:anyType">1233</saml:AttributeValue>
    <saml:AttributeValue xsi:type="xs:anyType">2511</saml:AttributeValue>
</saml:Attribute>
```
github_samlidentity_nameid: (GitHub.com) The NameID GitHub stores for that user, usually their email. Aikido uses it in two places: GitHub team sync, and linking a SAML user to the GitHub account that comments on a pull request so Can ignore issues applies. Team sync and this match only work when the person also signs in to GitHub with SAML. They must sign in to Aikido with SAML once after you add the claim. See Who can ignore a finding on a pull request.
```
<saml:Attribute Name="github_samlidentity_nameid">
    <saml:AttributeValue xsi:type="xs:anyType">example@email.com</saml:AttributeValue>
</saml:Attribute>
```
github_user_slug: (GitHub.com) The GitHub username, for example johndoe. Aikido matches it to the account that wrote a pull request comment, and uses it for GitHub team sync. When both this claim and github_samlidentity_nameid are stored, Aikido uses github_user_slug first. The person must sign in to Aikido with SAML once after you add the claim.
```
<saml:Attribute Name="github_user_slug">
    <saml:AttributeValue xsi:type="xs:anyType">johndoe</saml:AttributeValue>
</saml:Attribute>
```