Custom Identity Mappings
Specifying cross-service user relationships during IdP configuration
Last updated
Was this helpful?
Specifying cross-service user relationships during IdP configuration
Last updated
Was this helpful?
Custom Identity Mappings allow you to define relationships between user identities and groups across different systems integrated with Veza. When your organization's access federation doesn't automatically create these connections in Veza, you can specify patterns to map users between systems (for example, connecting an Okta user tom.shaw@veza.com
to a SQL Server login DOMAIN\tshaw
).
Use custom identity mappings to:
Connect IdP users (such as Okta users) to local accounts (such as Trino users)
Connect IdP groups to groups in downstream systems (such as Active Directory Group to Okta Group, or Azure AD Group to GitHub Team)
Define custom mapping rules for each integration, or use one mapping rule to link IdP identities or groups across multiple connected systems
Correlate identities in a to those in another integrated IdP such as Okta
Map IdP users to local users in a (as an alternative to using )
Define access-granting relationships for any user or group with the same name, email, or another property in the Veza graph database
Identify local account ownership using consistent naming patterns
You can configure mappings for one or more target data sources based on entity attributes or use templates to correlate identities and groups across multiple destination data sources.
Active Directory to SQL Server:
Source: AD User email admin@yourdomain.com
Destination: SQL Login YOURDOMAIN\admin
Configuration: Map email to unique ID, enable "ignore domain"
Okta to Custom Application:
Source: Okta user email jane.doe@company.com
Destination: App username jdoe
Configuration: Map email to custom property username
Azure AD to GitHub:
Source: Azure AD Group Engineering-Team
Destination: GitHub Team Engineering Team
Configuration: Map name to name, enable "ignore special characters"
Okta to Snowflake:
Source: Okta Group DataAnalysts
Destination: Snowflake Role DATA_ANALYSTS
Configuration: Map name to name, apply "UPPER" transformation
Multiple Resource Mapping:
Source: Active Directory Security Group Finance-Staff
Destinations:
Salesforce Group Finance Users
AWS IAM Group finance-users
Box Group Finance Department
Configuration: Single mapping configuration applying to multiple destination systems
Before configuring identity mappings:
Ensure both the source and destination systems are successfully integrated with Veza
Verify you have the necessary permissions to modify integration configurations
Identify the common attributes or patterns used to correlate identities across your systems
To enable custom mappings for an Identity or Cloud Provider:
Navigate to the Integrations page
Select a cloud or identity provider from the list and click Edit
Scroll down to the Mapping Configuration tab
Click Add Mapping Configuration
Enable Use Email By Default to automatically map users based on email attributes
For Mapping Mode, choose Users to create a rule for correlating individual identities. Choose Groups to connect source and destination groups.
For Destination Data Source Type, select the target system for identity mapping
Identity Mapping for Multiple Resources: If you need to configure identity mappings to many target systems, Veza supports using a single identity mapping configuration to connect users in the IdP to any number of destinations. Contact your Veza support representative to enable this feature. When enabled, you can select more than one Destination Data Source Types from the dropdown menu.
Click Add Property Matcher to create a mapping rule
Under Property Matchers, choose the source system attribute:
Email or Unique ID for native integrations like Okta
Template for pattern-based matching (see Template Transformations below)
Select the matching destination system property (Email, Unique ID, Template, or Custom)
Configure optional transformations:
Ignore Special Characters: Match identities that differ only by special characters (_
, -
, .
)
Ignore Domain: Match identities after removing domain portions
Add additional property matchers as needed (combined with OR
logic)
Click Save Configuration
Add identity matchers to correlate specific identities that don't meet the conditions of another property matcher:
Click Add Identity Matcher to add a mapping rule
In the leftmost dropdown, choose a specific identity from the source integration
Use the rightmost dropdown to pick the corresponding identity in the destination data source
Template transformations enable complex identity mapping patterns using property values and transformation functions. This feature is particularly useful when:
Source and destination systems use different naming conventions
You need to normalize user identifiers across systems
You want to define global mapping rules that work across multiple applications
Templates use property placeholders with optional transformation functions:
For example, to transform a user's name from "JOHN DOE" to "jdoe":
Templates support the user properties:
FirstName
: User's first name
LastName
: User's last name
FirstInitial
: First character of first name (equivalent to {FirstName | SUB_STRING,0,1}
)
LastInitial
: First character of last name (equivalent to {LastName | SUB_STRING,0,1}
)
Templates can use transformation functions to map identities based on a partial match or a variation of the source attribute.
SUB_STRING
Extracts a portion of text.
Parameters:
start_index: Starting position (0-based)
length: Number of characters to extract
Example: {FirstName | SUB_STRING,0,3}
for "John" returns "Joh"
UPPER
Converts all characters to uppercase.
Example: {FirstName | UPPER}
for "John" returns "JOHN"
LOWER
Converts all characters to lowercase.
Example: {FirstName | LOWER}
for "John" returns "john"
TRIM
Removes leading and trailing whitespace.
Example: {FirstName | TRIM}
for " John " returns "John"
Multiple functions can be chained together, applied left to right:
For a user "John Smith", this produces: "J.smith"
Here are some frequently used template patterns:
First initial + last name:
Example: "John Smith" → "jsmith"
First name + last initial:
Example: "John Smith" → "john.s"
Multiple property matchers can be combined using OR logic. The builder indicates these combinations with "OR" separators. For example:
This configuration would match any of these patterns for a user "John Smith":
john.smith
jsmith
john.smith@company.com
When using templates with multiple property matchers, a match on any single pattern is sufficient to create the identity mapping.
Common combinations for identity mapping include:
AWS IAM
AWS Redshift
AWS RDS MySQL
AWS RDS Postgres
SQL Server
Trino
Snowflake
GitHub
Salesforce
Box
Custom Application (OAA data provider)
Active Directory
Azure AD
Google Workspace
Okta
OneLogin
AWS Identity Center
Custom IDP (OAA identity provider)
Custom Property for OAA template integrations (enter the , e.g. idp_id
)