SAML assertion attribute to access token

You can create a post-login action so that during a post-login event for SAML connections, the expected SAML assertion attribute value is assigned to the access token that the app will receive.

resource "auth0_action" "map_saml_roles" {
  name    = "Map SAML roles"
  runtime = "node22"
  deploy  = true

  supported_triggers {
    id      = "post-login"
    version = "v3"
  }

  code = <<-JAVASCRIPT
    exports.onExecutePostLogin = async (event, api) => {
      if (event?.connection?.strategy !== "samlp") {
        return;
      }

      const { roles } = event.user;
      if (roles == null) {
        return;
      }

      api.accessToken.setCustomClaim(
        "https://example.com/claims/roles",
        roles
      );
    };
  JAVASCRIPT
}