> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Application mapping

> Shape the identity statement an application receives - the SAML assertion or OIDC token - by mapping profile attributes into it with IQL.

When someone signs in to an application through Iru, the app receives a signed
**identity statement** - a **SAML assertion** or an **OIDC ID token** - that says
who they are. **Application mapping** is how you decide what goes into that
statement: for each field the app expects, you map a value drawn from the person's
[profile](/en/identity/directory/schema).

<Info>
  Every mapped value is written in
  **[IQL](/en/identity/getting-started/iql-expressions)** (Iru Query Language) -
  the same expression language used for
  [Directory Sync attribute mapping](/en/identity/directory/attribute-mapping) and
  [Auto Group](/en/identity/directory/auto-groups) rules. A value can be a single
  profile field (`user.email`) or an expression that reshapes one
  (`user.email.lowerAscii()`).
</Info>

<Frame caption="The mapping editor: an IQL expression sets the Subject and each attribute, with the IQL explorer for the available fields and functions.">
  <img src="https://mintcdn.com/iru/J9e4tdSSyFEuoQS_/en/identity/images/application-mapping.webp?fit=max&auto=format&n=J9e4tdSSyFEuoQS_&q=85&s=bb84f049b896cb48a4821ec1b75f16c4" alt="The application Mapping editor for a SAML app: the Subject mapped from the IQL expression user.id with name format Unspecified, and an Email attribute mapped from user.primaryEmail.email with name format Basic." width="1130" height="1136" data-path="en/identity/images/application-mapping.webp" />
</Frame>

## What a mapping contains

Every application maps two things into the statement it sends:

* **The subject** - the primary identifier for the signed-in person.
* **Attributes or claims** - any additional fields the app expects.

```mermaid theme={null}
flowchart LR
  profile["User profile<br/>attributes"] --> expr["IQL expression"]
  expr --> subject["Subject"]
  expr --> attrs["Attributes / claims"]
  subject --> stmt["Signed assertion / token"]
  attrs --> stmt
  stmt --> app["Your application"]
```

### The subject

The subject identifies the signed-in person. Its default depends on the protocol:

| Protocol | Subject             | Default value   |
| -------- | ------------------- | --------------- |
| **SAML** | The **NameID**      | `user.username` |
| **OIDC** | The **`sub`** claim | `user.id`       |

You can change the value it draws from, and for SAML choose a **NameID format**.
See [SAML applications](/en/identity/applications/saml-applications) and
[OIDC applications](/en/identity/applications/oidc-applications) for the
protocol-specific options.

### Attributes and claims

Beyond the subject, add each field the app needs. For every one you set its
**name** (what the app expects), its **value** (the IQL expression that produces
it), a protocol detail (an **attribute name format** for SAML, or a **scope** for
OIDC), and whether it is **enabled**.

## How you build a mapping

<Steps>
  <Step title="Open the app's mapping" icon="diagram-project">
    Mapping lives in the application's **draft**, alongside its protocol settings.
  </Step>

  <Step title="Write an IQL expression per field" icon="code">
    For the subject and each attribute or claim, write an
    [IQL](/en/identity/getting-started/iql-expressions) expression. The editor
    suggests the available `user` fields and functions as you type and checks the
    expression, so mistakes surface before you publish.
  </Step>

  <Step title="Preview the result" icon="eye">
    A live **preview** renders the exact assertion or token Iru will send, so you
    can confirm its shape before going live.
  </Step>

  <Step title="Publish" icon="circle-check">
    Set the draft as **current** to make the mapping live. See
    [Applications overview](/en/identity/applications/applications-overview) for the
    version model.
  </Step>
</Steps>

<Tip>
  Map only what the app needs. Each app receives exactly the attributes you map
  into it, so a given service sees only the profile details required to identify
  the person.
</Tip>

## Mapping for provisioning

Mapping shapes more than sign-on. For apps with
[provisioning](/en/identity/applications/provisioning), the mapping also has a
**provisioning view** that controls which profile attributes Iru sends when it
creates or updates the account in the app.

## Where to go next

<CardGroup cols={2}>
  <Card title="Iru Query Language" icon="brackets-curly" href="/en/identity/getting-started/iql-expressions">
    The full IQL reference - fields, operators, functions, and examples.
  </Card>

  <Card title="SAML applications" icon="file-signature" href="/en/identity/applications/saml-applications">
    NameID formats and attribute mapping for SAML apps.
  </Card>

  <Card title="OIDC applications" icon="id-card" href="/en/identity/applications/oidc-applications">
    Subject and claim mapping for OIDC apps.
  </Card>

  <Card title="Provisioning" icon="arrows-rotate" href="/en/identity/applications/provisioning">
    Map the attributes Iru sends when it creates and updates accounts in an app.
  </Card>
</CardGroup>