> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# SAML v2 Populate Lambda | FusionAuth Docs

An overview of the SAML v2 populate lambda.

# SAML v2 Populate Lambda

[Edit on GitHub](https://github.com/FusionAuth/fusionauth-site/blob/main/astro/src/content/docs/extend/code/lambdas/samlv2-response-populate.mdx)

[View Markdown](https://fusionauth.io/docs/extend/code/lambdas/samlv2-response-populate.md)

In order to handle complex integrations with SAML service providers, you can specify a lambda to be used by a FusionAuth application acting as SAML identity provider (IdP). This lambda will be invoked prior to the SAML response being sent back to the service provider.

When you create a new lambda using the FusionAuth UI we will provide you an empty function for you to implement.

## Lambda Structure

If you are using the API to create the lambda you will need to ensure your function has the following signature:

```javascript
function populate(samlResponse, user, registration, context) {
  // Lambda code goes here
}
```

This lambda must contain a function named `populate` that accepts the following parameters:

*   `samlResponse` - the SAML v2 response object. You can modify this object.
*   `user` - the FusionAuth User object. This object is read-only.
*   `registration` - the FusionAuth UserRegistration object. This object is read-only.
*   `context` - Available since 1.64.0 - an object containing the context of the request, including access to [secrets](https://fusionauth.io/docs/extend/code/lambdas.md#secrets). This object is read-only.

The two FusionAuth objects are well documented in the [User API](https://fusionauth.io/docs/apis/users.md) and [Registration API](https://fusionauth.io/docs/apis/registrations.md) documentation. The SAML response object mimics the format of the XML document, but is designed to be much simpler to use than dealing with the DOM object model. Here is a list of the fields you have access to manipulate in the SAML response:

### SAML Response Fields

`samlResponse.assertion.attributes`Map<String, List<String>>

A map of the attributes of the user. This is sometimes call the claims of the user. Since SAML attributes can be multi-valued, you will need to wrap single values in Arrays like this:

```javascript
samlResponse.assertion.attributes['firstName'] = [user.firstName];
```

`samlResponse.assertion.conditions.audiences`Array<String>

A list of the audiences for this SAML response. By default, the `audience` or `issuer`, in that order, from the corresponding SAML identity provider configuration are used.

`samlResponse.assertion.conditions.notBefore`Long

The instant that this assertion starts being valid. This is the number of milliseconds since Epoch UTC.

`samlResponse.assertion.conditions.notOnOrAfter`Long

The instant that this assertion stops being valid. This is the number of milliseconds since Epoch UTC.

`samlResponse.assertion.issuer`String

The issuer of this SAML assertion. This defaults to the `issuer` from the corresponding SAML identity provider configuration.

`samlResponse.assertion.subject.nameID.format`StringDEPRECATED

The `NameID` format for the id of the subject (user). FusionAuth uses the `emailaddress` format specified by the SAML specifications. It is not recommended that you change this unless you know what you are doing.

Removed in 1.28.0

`samlResponse.assertion.subject.nameID.id`StringDEPRECATED

The `NameID` id of the subject (user). This defaults to the user's email address. It is not recommended that you change this unless you know what you are doing.

Removed in 1.28.0

`samlResponse.assertion.subject.nameIDs`ArrayAvailable since 1.28.0

The list of NameId objects.

Prior to version `1.28.0`, this field was a single entry but has since been converted to an array.

`samlResponse.assertion.subject.nameIDs[x].format`StringAvailable since 1.28.0

The `NameID` format for the id of the subject (user). FusionAuth uses the `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` format specified by the SAML specifications by default. It is not recommended that you change this unless you know what you are doing.

`samlResponse.assertion.subject.nameIDs[x].id`StringAvailable since 1.28.0

The `NameID` id of the subject (user). This defaults to the user's email address. It is not recommended that you change this unless you know what you are doing.

`samlResponse.assertion.subject.confirmation.inResponseTo`String

This is the ID from the SAML request. It is not recommended that you change this unless you know what you are doing.

`samlResponse.assertion.subject.confirmation.method`String

The confirmation method FusionAuth uses for the subject (user). This default to `Bearer`. It is not recommended that you change this unless you know what you are doing.

`samlResponse.assertion.subject.confirmation.notBefore`Long

The instant that this assertion's subject starts being valid. This is the number of milliseconds since Epoch UTC.

`samlResponse.assertion.subject.confirmation.notOnOrAfter`Long

The instant that this assertion's subject stops being valid. This is the number of milliseconds since Epoch UTC.

`samlResponse.assertion.subject.confirmation.recipient`String

The recipient of the subject. This defaults to the callback URL (ACS).

`samlResponse.assertions`ArrayAvailable since 1.60.0

An array containing all assertions on the SAML response. You can use this array to inspect the original assertions on the response instead of the combined **assertion**.

`samlResponse.destination`String

The destination of the SAML response. This defaults to the callback URL (ACS).

`samlResponse.id`String

A unique identifier for the SAML response that is generated by FusionAuth.

`samlResponse.inResponseTo`String

This is the ID from the SAML request. It is not recommended that you change this unless you know what you are doing.

`samlResponse.issueInstant`Long

The instant that this assertion was created. This is the number of milliseconds since Epoch UTC.

`samlResponse.issuer`String

This is the issuer of the SAML response. This defaults to the name of this FusionAuth deployment.

`samlResponse.status.code`String

The status code of the SAML response. Whenever the lambda is called, this will always be `Success`.

`samlResponse.status.message`String

The status message of the SAML response. Whenever the lambda is called, this will always be `null`.

## Assigning The Lambda

Once a lambda is created, you may assign it to one or more applications in the SAML configuration. See the SAML tab in the Application configuration.

## Example Lambda

Here is an example of a simple Lambda that sets a few extra parameters into the SAML response from the User, including some custom data:

```javascript
function populate(samlResponse, user, registration) {
  // Set an attribute named 'roles' from the User assigned roles for this registration
  samlResponse.assertion.attributes['roles'] = registration.roles || [];
  // Set an attribute named 'favoriteColor' using the custom data attribute named 'favoriteColor'
  samlResponse.assertion.attributes['favoriteColor'] = [user.data.favoriteColor];
}
```