OIDC/SAML Claims: Supporting Multiple Values in Security Filters

How It Works

1. In the Identity Provider (IdP), the claim’s value is formatted as a single string with a delimiter between values (e.g., 32;79;90).
2. The claim is mapped to a system prompt during authentication (see the standard
3. In the Strategy project, a security filter uses a custom expression to check if a data attribute value is present inside that delimited list.

The core logic uses the Position function to safely test membership, avoiding partial matches:

Position(Concat("<delimiter>",<AttributeForm>,"<delimiter>"), Concat("<delimiter>",?<SystemPrompt>,"<delimiter>")) > 0

Configuration Steps

Prerequisites

• OIDC or SAML authentication is configured and the claim > system prompt mapping is working.
• The system prompt has been created and tested with single values.

Create the Security Filter Expression

1. Go to the security filter editor.

2. Choose Custom expression as the qualification type.

3. Enter an expression such as: Position(Concat(";",FI@[ID],";"),Concat(";",?[59 SSO Text Attribute 1],";"))>0
4. Replace FI@ID above with the attribute form you want to filter on and replace ?[59 SSO Text Attribute 1] above with your system prompt object.
5. The delimiter (;) is added before and after both sides to prevent false matches (for example, "32" won't accidentally match "322").

Assign the Security Filter

Apply the filter to the appropriate users or user groups, as you would with any other security filter.

Set the Claim Value in the IdP

The claim you mapped to the system prompt must be populated with a delimited string (for example: 32;79;90) or a single value (for example: 32).

The same delimiter must be used in the IdP value and in the security filter expression. The example uses ;(semicolon).

Delimiter Choice

• The recommended delimiter is semicolon (;) because it is rarely part of attribute values and works well in expressions.
• Any character not present in your data values can be used, such as | or ,.
• Consistency is critical: the delimiter in the claim value must match the delimiter used in the Concat calls in the security filter expression.

Maximum Length

• The combined length of the claim string is subject to the system prompt length limit.
• In current versions, system prompts typically support up to 5000 characters.
• If your list of values routinely exceeds this limit, consider:
• Using shorter identifiers (e.g., numeric IDs instead of long GUIDs).
• Aggregating values into higher-level groups.
• Reaching out to Strategy support for alternative approaches.

Example Use Case

An OEM platform assigns one or more Financial Institutions (FI) to each user:

• Use A - claim value: 32
• User B - claim value: 32;79;90

Security filter expression (where FI IDs are stored in the attribute FI@ID):

Position(Concat(";",FI@ID,";"),Concat(";",?[FI_List_Prompt],";"))>0

For User A, only rows where FI@ID = 32 pass the filter.

For User B, only rows with FI@ID = 32, 79, or 90 are included.

Best Practice

• Always wrap both sides with the delimiter to prevent substring mismatches.
• Escape or avoid using the delimiter character inside the actual attribute values.
• Test with single and multiple values to verify the filter works correctly after any changes.
• Monitor the length of the claim to stay within system prompt limits.

Additional Information

Enable Single Sign-On with OIDC Authentication

Enable Single Sign-On with SAML Authentication