SAML auto user provisioning
Configure SAML auto user provisioning to create, update, and assign roles to users based on IdP attributes.
Overview
SAML Auto User Provisioning automatically creates and updates Concierge users when they sign in through your Identity Provider (IdP).
In addition to creating users, Concierge can automatically assign users to Services and Roles based on SAML attributes provided by your Identity Provider.
Customers can choose between two methods for assigning Service access and Roles.
Option 1: Single Role Assignment (Simple)
This method uses separate SAML attributes for Service Codes and Role.
A user may be assigned to multiple Services, but can only have a single Role across all assigned Services.
Example
| Attribute | Value |
| ServiceCodes | PROPERTY001,PROPERTY002,PROPERTY003 |
| Role | AGENT |
Result:
| Service | Role |
| PROPERTY001 | AGENT |
| PROPERTY002 | AGENT |
| PROPERTY003 | AGENT |
Best For
Organizations where users typically have the same role across all properties or locations.
Option 2: Service-Specific Role Assignment (Advanced)
This method uses a single SAML attribute that combines Service Codes and Roles.
A user may be assigned different Roles for different Services.
Format
{ServiceCode}_{Role}Example
PROPERTY001_AGENT,PROPERTY002_MANAGER,PROPERTY003_ADMINResult:
| Service | Role |
| PROPERTY001 | AGENT |
| PROPERTY002 | MANAGER |
| PROPERTY003 | ADMIN |
Best For
Organizations where users require different levels of access at different properties, locations, or business units.
Service Codes
A Service Code is a customer-defined identifier that represents a specific property, location, business unit, or other organizational entity.
During implementation, Medallia Concierge will configure a mapping between your Service Codes and the corresponding Services within Concierge.
Role Mapping
Role values are customer-defined.
Examples include:
AGENT MANAGER ADMINDuring implementation, Medallia Concierge will configure a mapping between the role values provided by your Identity Provider and the appropriate Concierge role.
Examples:
| Customer Role | Concierge Role |
| AGENT | Standard User |
| MANAGER | Standard User with additional permissions |
| ADMIN | Administrator |
The specific mappings are determined during implementation and can be customized to meet your organization's requirements.
Concierge supports Administrator roles as well as multiple Standard User permission configurations.
Required User Attributes
Your SAML assertion must provide the following user information:
| Attribute | Description |
| Username | Unique identifier for the user (often an email address, but not required) |
| First Name | User's first name |
| Last Name | User's last name |
Important Notes
-
Service Codes are customer-defined and mapped to Concierge Services during implementation.
-
Role values are customer-defined and mapped to Concierge roles during implementation.
-
Multiple Service assignments must be comma-separated.
-
For Service-Specific Role Assignment, the underscore (
_) separator between Service Code and Role is required. -
Hyphens, colons, and other separators are not supported.
Getting Started
To enable SAML Auto User Provisioning, please provide the following information to your Medallia Concierge representative.
1. Select a Provisioning Method
Choose one of the following options:
-
Option 1: Single Role Assignment
-
Separate Service Code and Role attributes
-
One role per user across all Services
-
-
Option 2: Service-Specific Role Assignment
-
Combined Service Code and Role values
-
Different roles per Service
-
2. Provide User Attribute Names
Identify the SAML attributes that contain:
-
Username
-
First Name
-
Last Name
Example:
| User Information | SAML Attribute |
| Username | userName |
| First Name | firstName |
| Last Name | lastName |
3. Provide Service Assignment Attribute(s)
Option 1: Single Role Assignment
Provide:
-
Service Code attribute name
-
Role attribute name
Example:
| Purpose | SAML Attribute |
| Service Codes | serviceCodes |
| Role | role |
Option 2: Service-Specific Role Assignment
Provide:
-
Service assignment attribute name
Example:
| Purpose | SAML Attribute |
| Service Assignments | ServicePermissions |
4. Provide Service Code Mapping
Provide a list of Service Codes and the Concierge Services they should map to.
Example:
| Service Code | Concierge Service |
| PROPERTY001 | Downtown Hotel |
| PROPERTY002 | Airport Hotel |
5. Define Role Mapping
Provide the role values that will be sent by your Identity Provider and how they should map to Concierge permissions.
Example:
| SAML Role | Concierge Role |
| AGENT | Standard User |
| MANAGER | Standard User with additional permissions |
| ADMIN | Administrator |
6. Provide a Sample SAML Assertion
Please provide a sample SAML assertion containing all required attributes so Medallia can validate the configuration before enabling provisioning.
7. Validate and Test
Before enabling provisioning for all users, Medallia recommends validating the configuration using one or more test accounts to confirm:
-
User creation
-
User updates
-
Service assignments
-
Role assignments
-
SSO login experience
