Attribute Mapping and Syncing

Wristband keeps user data synchronized with an enterprise IdP through attribute mapping and attribute syncing:

• Attribute Mapping: For enterprise IdPs using SAML, you configure how SAML assertion attributes map to Wristband user attributes. For enterprise IdPs using OIDC, Wristband automatically maps standard claims from the UserInfo endpoint and ID token to the corresponding Wristband user attributes.
• Attribute Syncing: For both SAML and OIDC enterprise IdPs, you can configure Wristband to update specified user attributes on every login, keeping Wristband user data in sync with the external IdP.

How Attribute Mapping Works

Attribute mapping applies to enterprise IdPs using SAML. SAML has no standardized attribute naming convention. One SAML IdP might send a user's email as email, another as emailaddress, and a third as a full URI like http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

Attribute mappings tell Wristband which incoming SAML attributes correspond to which fields on the Wristband user. On each login, Wristband reads the attributes from the incoming SAML assertion and maps their values to one of the following Wristband user attributes:

• id
• email
• emailVerified
• givenName
• familyName
• fullName
• phoneNumber
• birthdate
• groups

Configuring Attribute Mapping

1. Navigate to Tenant View in the Wristband dashboard.
2. Select Identity Providers -> Enterprise from the side navigation menu.
3. Click the enterprise IdP you want to configure.

4. Go to its User Syncing section.
5. Click the Add Mapping button.

6. In the modal that pops up, enter the following values:
   • IdP Attribute (Source): The exact name of the attribute as it appears in the SAML assertion.
   • Wristband Attribute (Destination): Select the Wristband user attribute that the IdP attribute should be mapped to.
7. Click Create to finalize the mapping.

How Attribute Syncing Works

Attribute syncing is supported for both SAML and OIDC enterprise IdPs. On every login, Wristband updates the configured user attributes with values from the external IdP.

• SAML integrations: Values are extracted from the incoming SAML assertion using your configured attribute mappings.
• OIDC integrations: Values are obtained from standard claims in the ID token or UserInfo endpoint.

You can configure attribute syncing for the following Wristband user attributes:

• birthdate
• email
• fullName
• givenName
• familyName
• phoneNumber

Required Attributes

If a Wristband user attribute is marked as required and the external IdP provides an undefined or null value for that attribute, Wristband retains the existing value rather than clearing it.

For example, if email is configured for attribute syncing and the external IdP returns a null value for the user's email, Wristband retains the user's existing email address.

Email Verification

If email is configured for attribute syncing and Wristband detects that the user's email address has changed in the external IdP, Wristband checks the incoming IdP assertion to determine whether the new email address has been verified. If the assertion confirms that the email address is verified, Wristband sets the user's emailVerified attribute to true. Otherwise, if the email address is unverified or its verification status cannot be determined, Wristband initiates its own email verification workflow.

Email Verification Workflow

When email verification is required, users can verify their email address in one of two ways:

• Verify before login: Users enter a one-time password on the login screen. They cannot complete authentication until their email address is verified.
• Verify after login: Users complete authentication before Wristband asynchronously sends them a verification email. The email is sent only when the user's email address changes and is not resent on subsequent logins unless the email address changes again.

To configure email verification behavior, navigate to Workflow Policies in the Wristband Dashboard and locate the Enterprise IdP Login (SSO) section. There, you can select the strategy Wristband uses when processing an unverified email address.

For configuration details, see the Login Workflow documentation.

Explicit Email Verification

For Microsoft Entra ID and custom SAML IdPs, you can configure a list of trusted email domains whose email addresses should be considered verified. When syncing the user's email, Wristband automatically marks the email address as verified if its domain matches an entry in this list.

Configuring Attribute Syncing

1. Navigate to Tenant View in the Wristband dashboard.
2. Select Identity Providers -> Enterprise from the side navigation.
3. Click the enterprise IdP you want to configure.

4. Go to its User Syncing section.
5. Choose the fields you want to update from the User Attributes to Sync on Login selector.
6. Click Save to apply your synchronization changes.