Configure Assertion Creation

On the Assertion Creation tab, click CONFIGURE ASSERTION CREATION.
Check Standard, then click Next.
In the SAML_SUBJECT dropdown, select urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified:

Under Extend the Contract, click the Add button on the right and create each of the following attributes:


Attribute	Format	Description
`ent`	All attributes use the format urn:oasis:names:tc:SAML:2.0: attrname-format:basic	This is a static value provided by Lookout. It is the GUID generated when creating the enterprise tenant, for example: `7e1a2620-b8ab-4fd1-a8c7-4a2b980ec23a`
`givenname`		The user's first name.
`mail`		The user's email.
`memberof`		The user's group membership.
`sn`		The user's last name.
`upn`		AD User Principal name.

Click Next.
Click Map New Adapter Instance:
Under Adapter Contract, select RETRIEVE ADDITIONAL ATTRIBUTES FROM MULTIPLE DATA STORES USING ONE MAPPING, then click Next.
Select your data source.
The example below uses an LDAP instance.
In the LDAP Directory Search tab, select the attributes that map to the custom attributes created in Step 4:
In the LDAP Filter tab, create a search filter that looks up user information based on the username value:
Click Done.
In the Attribute Contract Fulfillment tab, map the SAML attributes from your new Active Directory or LDAP Adapter, with two exceptions:
- SAML_SUBJECT uses the default Adapter value to get the username from the login HTML form.
- ent takes the enterprise tenant GUID, which is provided to you by Lookout.
On the Issuance Criteria tab, optionally select authorization conditions, then click Next.
Click Done.
On the Authentication Source Mapping tab, click Next.
Click Done.
On the Assertion Creation tab, click Next.

Lookout Product Documentation