1Kosmos Attributes

1Kosmos attributes let you define exactly what gets shared.

---

Overview

Passwordless login for SAML applications works best when the target app knows enough about the user to authorize them correctly. Some service providers need only a simple profile (username, email); others expect richer user data.

There are two types of attributes:

• Session attributes — managed by the community administrator
• Ledger attributes — managed by 1Kosmos

Session attributes

You're mapped by default with firstname, lastname, status, username, email, and phone. Add any other user attributes needed to identify the user.

To view the user profile, create an attribute called uid and map it to the LDAP directory attribute named uid. See LDAP Directory Integration for how to map 1Kosmos attributes to directory attributes.

Note: As a second step, these attributes must be mapped to directory attributes so the system knows where to pick up their values.

Add a session attribute:

1. Log in to your tenant as a community administrator.
2. Navigate to Settings > 1Kosmos Attributes.
3. Click Add new.
4. In the Create Attribute window, enter the attribute name and click Create. A 1Kosmos attribute created successfully message confirms it, and the new attribute appears in the list.

Delete a session attribute:

1. On the 1Kosmos Attributes screen, click the Delete icon for the attribute.
2. In the confirmation dialog, click Delete. A 1Kosmos attribute deleted successfully message confirms the removal.

Ledger attributes

Ledger attributes are managed by 1Kosmos and limited to five. When available, they can be returned as part of the SAML response:

• device_info — device information
• dl — driver's license
• aal — authentication assurance level
• ial — identity assurance level
• ppt — passport