Supported claims

PassBeyond maps common provider-specific SAML attribute names to stable internal keys. For each single-valued key, aliases are tried in the listed order and the first non-empty value wins.

Each normalized value becomes an X-Passbeyond-Data-* backend header. The email and sAMAccountName keys also participate in subject selection.

Distinguished name

Normalized key: distinguishedName

1. DN
2. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/distinguishedname
3. http://schemas.xmlsoap.org/claims/DistinguishedName

User principal name

Normalized key: UPN

1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn
2. http://schemas.xmlsoap.org/claims/UPN

Common name

Normalized key: CommonName

1. http://schemas.xmlsoap.org/claims/CommonName
2. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Account name

Normalized keys: sAMAccountName and compatibility key username

1. http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname
2. http://schemas.xmlsoap.org/claims/WindowsAccountName
3. http://schemas.goauthentik.io/2021/02/saml/username

Email

Normalized key: email

1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
2. http://schemas.xmlsoap.org/claims/EmailAddress
3. mail
4. email

Given name

Normalized key: givenname

1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
2. http://schemas.xmlsoap.org/claims/GivenName
3. givenName
4. firstName

Surname

Normalized key: surname

1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
2. http://schemas.xmlsoap.org/claims/Surname
3. sn
4. surName
5. lastName

Company

Normalized key: company

1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/company
2. http://schemas.xmlsoap.org/claims/Company
3. company

Department

Normalized key: department

1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department
2. http://schemas.xmlsoap.org/claims/Department
3. department

Telephone number

Normalized key: telephoneNumber

1. telephoneNumber
2. telephone
3. phone
4. mobile

Groups

Normalized key: groups

1. http://schemas.xmlsoap.org/claims/Group
2. http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
3. memberOf
4. Groups
5. groups

Groups remain multi-valued in the session and are sent to the backend as a comma-separated header value. When a provider supplies one delimited string instead, commas, semicolons, and vertical bars are recognized as separators.

Missing an attribute?

Open an issue or merge request in the PassBeyond repository with sanitized example attribute names, the Identity Provider, and the intended normalized field. Never include a real SAML assertion, session cookie, access token, or personal attribute value.