Is group name case sensitive in SAML payload (in Palantir Foundry context)?

Question

During a SAML login via multipass, a list of groups is provided in the payload in <saml:Attribute Name="https://schemas.xmlsoap.org/claims/Group" ...>

Are these groups matched case-sensitively? i.e.: Will a group that was provided as "AbcDef" earlier, but is provided as "abcdef" later be treated as the same group or not?

Answer 1

You can now modify your SAML configuration in a self-serve way via Foundry Control Panel.

For user attributes: please reach out through your internal support channel if you'd like to make user attributes case-sensitive - this option isn't available in the UI.

For user groups: case sensitivity isn't currently supported for user groups. You need to enable the “Import user groups from the identity provider” option to populate a user's groups via SAML.

Answer 2

This is a multipass configuration service level configuration. You will need access to the gemini or the infrastructure that configures the stack itself to change it. If you don't please reach out through your internal support channels.

What you want is to add caseInsensitive to the type in your atributes. i.e.:

users:
  attributes:
    'multipass:email:primary':
      - Email
    'multipass:family-name':
      - 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'
    'multipass:given-name':
      - 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'
  id:
    fields:
      - NameID
    type: caseInsensitive
  username:
    - NameID