Applies to
- Enterprise
SAML assertion: Supported claims examples in Smartsheet
A reference for supported claims and SAML assertion examples.
Who can use this?
Plans:
- Smartsheet
- Enterprise
Required attributes
For successful sign in authentication, both the Persistent ID and Email Address claims need to be passed to Smartsheet. This requires two separate claims.
Find additional details below.
Persistent ID
This is the attribute that is least likely to change for an identity. Smartsheet accepts six formats (a few of them aren't specified in the SAML 2.0 standard) encoded in the NameID element. Here are the formats we support:
- urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
- urn:oasis:names:tc:SAML:2.0:nameid-format:email
- urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
- urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified
- urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
- urn:oid:1.3.6.1.4.1.5923.1.1.1.10
Smartsheet also accepts assertions without a NameID element and extracts a Persistent ID value from an attribute if there's an attribute that matches the following:
- name="eduPersonPrincipalName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"
- name="persistent" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
- name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
- name="eduPersonPrincipalName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
Email address
This is the email address associated with the Smartsheet account. This equates to a username in the Smartsheet service. This must be an attribute and isn't be extracted from the NameID element.
These are the accepted formats:
- name="email" name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
- name="emailAddress",nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="Email",nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="saml_username",nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="emailaddress",nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
- name="emailaddress",nameFormat="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
- name="urn:oid:0.9.2342.19200300.100.1.3",nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
- name="mail",nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
Optional attributes
Given name
The given name of the person associated with the account (first name).
These are the supported formats:
- name="givenName" name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
- name="givenname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="given_name" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="givenname" nameFormat="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
- name="givenname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
- name="urn:oid:2.5.4.42" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
Surname
The surname of the person associated with the account (last name).
These are the supported formats:
- name="surname"
- name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
- name="surname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="sur_name" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
- name="surname" nameFormat="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
- name="surname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
- name="urn:oid:2.5.4.4" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
Sample assertion
When you generate metadata, you must use the claims given above.
The following link provides examples of SAML response assertions:
https://www.samltool.com/generic_sso_res.php
These examples are for illustrative purposes only and won't work in Smartsheet. Your metadata must be generated by your IdP.