Custom Identity Mappings

Overview

Custom Identity Mappings allow you to define relationships between user identities and groups across different systems integrated with Veza. When your organization's access federation doesn't automatically create these connections in Veza, you can specify patterns to map users between systems (for example, connecting an Okta user [email protected] to a SQL Server login DOMAIN\tshaw).

Use custom identity mappings to:

• Connect IdP users (such as Okta users) to local accounts (such as Trino users)

• Connect IdP groups to groups in downstream systems (such as Active Directory Group to Okta Group, or Azure AD Group to GitHub Team)

• Define custom mapping rules for each integration, or use one mapping rule to link IdP identities or groups across multiple connected systems

Native vs Custom Identity Mappings

Veza automatically creates identity relationships for certain integration pairs without requiring custom configuration. This is called native identity mapping.

Integration Pairs with Native Mapping

The following integration pairs automatically create bidirectional identity relationships:

When do you need custom identity mappings?

• You're connecting integrations that don't have native mapping

• You need to map users/groups using different attributes than the native logic

• You're connecting custom applications or custom identity providers built with OAA

Examples

You can configure mappings for one or more target data sources based on entity attributes or use templates to correlate identities and groups across multiple destination data sources.

User Identity Mapping

1. Active Directory to SQL Server:

   • Source: AD User email [email protected]

   • Destination: SQL Login YOURDOMAIN\admin

Group Identity Mapping

1. Azure AD to GitHub:

   • Source: Azure AD Group Engineering-Team

   • Destination: GitHub Team Engineering Team

Role to user identity mapping (AWS only)

AWS integrations support mapping IAM Roles directly to local users in downstream applications. This is useful when IAM roles represent service accounts or federated identities that correspond to application-level users.

1. AWS IAM Role to Custom Application User:

   • Source: AWS IAM Role DataAnalyticsRole

   • Destination: Custom Application User analytics-service

To configure role to user mapping:

1. Edit your AWS integration and navigate to Mapping Configuration

2. Select Roles to Users as the Mapping Mode

3. Choose a destination data source type (Custom Application, Snowflake, SQL Server, etc.)

Prerequisites

Before configuring identity mappings:

• Ensure both the source and destination systems are successfully integrated with Veza

• Verify you have the necessary permissions to modify integration configurations

• Identify the common attributes or patterns used to correlate identities across your systems

Enabling Identity Correlation

To enable custom mappings for an Identity or Cloud Provider:

1. Navigate to the Integrations page

2. Select a cloud or identity provider from the list and click Edit

3. Scroll down to the Mapping Configuration tab

Identity Matchers

Add identity matchers to correlate specific identities that don't meet the conditions of another property matcher:

1. Click Add Identity Matcher to add a mapping rule

2. In the leftmost dropdown, choose a specific identity from the source integration

3. Use the rightmost dropdown to pick the corresponding identity in the destination data source

Template Transformations

Template transformations use property values and transformation functions to match identities across systems with different naming conventions. This feature is particularly useful when:

• Source and destination systems use different naming conventions

• You need to normalize user identifiers across systems

• You want to define global mapping rules that work across multiple applications

Template Syntax

The following sections document the template patterns and transformation functions that Veza uses internally to match identities. When you select a template from the dropdown menu, Veza applies these patterns automatically. This reference helps you understand which pre-configured template option to choose for your identity matching needs.

Templates use property placeholders with optional transformation functions:

For example, a template pattern that transforms a user's name from "JOHN DOE" to "jdoe" would be written as:

Supported Properties

Templates support the user properties:

• FirstName: User's first name

• LastName: User's last name

• FirstInitial: First character of first name (equivalent to {FirstName | SUB_STRING,0,1}

Transformation Functions

Templates can use transformation functions to map identities based on a partial match or a variation of the source attribute.

SUB_STRING

Extracts a portion of text.

• Parameters:

  • start_index: Starting position (0-based)

  • length: Number of characters to extract

UPPER

Converts all characters to uppercase.

• Example: {FirstName | UPPER} for "John" returns "JOHN"

LOWER

Converts all characters to lowercase.

• Example: {FirstName | LOWER} for "John" returns "john"

TRIM

Removes leading and trailing whitespace.

• Example: {FirstName | TRIM} for " John " returns "John"

Function Composition

Multiple functions can be chained together, applied left to right:

For a user "John Smith", this produces: "J.smith"

Common Template Patterns

Here are some frequently used template patterns:

1. First initial + last name:

   Example: "John Smith" → "jsmith"

2. First name + last initial:

   Example: "John Smith" → "john.s"

Using OR Logic with Templates

Multiple property matchers can be combined using OR logic. The builder indicates these combinations with "OR" separators. For example:

This configuration would match any of these patterns for a user "John Smith":

• john.smith

• jsmith

• [email protected]

When using templates with multiple property matchers, a match on any single pattern is sufficient to create the identity mapping.

Identity Mapping Use Cases

Common identity mapping combinations include:

Target Systems:

• AWS IAM

• AWS Redshift

• AWS RDS MySQL

• AWS RDS Postgres

Identity Providers:

• Active Directory

• Azure AD

• Google Workspace

• Okta

AWS-Specific:

• AWS IAM Roles → Local Users in any destination system (Roles to Users mode)