Attribute Mapping

When users authenticate via OIDC or SAML, Concourse extracts user information from the identity provider’s response to create or update user profiles.

Mapped attributes

User field	OIDC claim	SAML attributes (tried in order)
Email	email	email, mail, emailaddress, NameID
Name	name	displayName, givenName, name

OIDC claim extraction

Concourse reads the email and name claims from the ID token returned by the identity provider. These are standard OpenID Connect claims and are supported by all major providers.

If the email claim is missing, authentication fails. If the name claim is missing, the email local part is used as the display name.

SAML attribute extraction

For SAML assertions, Concourse checks multiple attribute names to accommodate different IdP configurations:

Email is resolved by checking these attributes in order:

1. email
2. mail
3. emailaddress
4. NameID (fallback)

Name is resolved by checking these attributes in order:

1. displayName
2. givenName
3. name

Configure your IdP to send at least one of these attributes in the SAML assertion.

Auto-provisioning behavior

When a user authenticates via SSO for the first time:

1. Concourse checks if a user with the extracted email already exists.
2. If the user exists, Concourse issues a JWT for that user.
3. If the user does not exist, Concourse creates a new user with:
   • The extracted email address
   • The extracted display name
   • The member role

Admins can change a user’s role after provisioning through the admin panel or the API.

IdP configuration tips

To ensure consistent attribute mapping, configure your IdP to release the following attributes:

IdP	Email attribute	Name attribute
Okta	email (default)	displayName or name
Azure AD	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
OneLogin	email	name
Google	email (OIDC claim, default)	name (OIDC claim, default)

For Azure AD SAML, map the short attribute names (email, displayName) in the attribute statements to simplify the mapping.