diff --git a/manifests/init.pp b/manifests/init.pp
index 0869a5b..18ebf79 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -14,6 +14,8 @@
   String $subdomain,
   String $slurm_user = 'slurm',
   Enum['ldap', 'saml2'] $auth_type = 'ldap',
+  Array[Hash[String, String]] $staff_attributes = [],
+  Array[Hash[String, String]] $required_access_attributes = [],
   Optional[String] $slurm_db_ip = undef,
   Optional[Integer] $slurm_db_port = undef,
 ) {
@@ -34,22 +36,24 @@
     show_diff => false,
     content   => epp('metrix/91-local.py',
       {
-        'password'        => $password,
-        'slurm_user'      => $slurm_user,
-        'slurm_password'  => $slurm_password,
-        'cluster_name'    => $cluster_name,
-        'secret_key'      => stdlib::seeded_rand_string(32, $password),
-        'domain_name'     => $domain_name,
-        'subdomain'       => $subdomain,
-        'logins'          => $logins,
-        'prometheus_ip'   => $prometheus_ip,
-        'prometheus_port' => $prometheus_port,
-        'db_ip'           => $db_ip,
-        'db_port'         => $db_port,
-        'slurm_db_ip'     => pick($slurm_db_ip, $db_ip),
-        'slurm_db_port'   => pick($slurm_db_port, $db_port),
-        'base_dn'         => $base_dn,
-        'ldap_password'   => $ldap_password,
+        'password'                   => $password,
+        'slurm_user'                 => $slurm_user,
+        'slurm_password'             => $slurm_password,
+        'cluster_name'               => $cluster_name,
+        'secret_key'                 => stdlib::seeded_rand_string(32, $password),
+        'domain_name'                => $domain_name,
+        'subdomain'                  => $subdomain,
+        'logins'                     => $logins,
+        'prometheus_ip'              => $prometheus_ip,
+        'prometheus_port'            => $prometheus_port,
+        'db_ip'                      => $db_ip,
+        'db_port'                    => $db_port,
+        'slurm_db_ip'                => pick($slurm_db_ip, $db_ip),
+        'slurm_db_port'              => pick($slurm_db_port, $db_port),
+        'base_dn'                    => $base_dn,
+        'ldap_password'              => $ldap_password,
+        'staff_attributes'           => $staff_attributes,
+        'required_access_attributes' => $required_access_attributes,
       }
     ),
     owner     => 'apache',
diff --git a/templates/91-local.py.epp b/templates/91-local.py.epp
index 68214ba..00449db 100644
--- a/templates/91-local.py.epp
+++ b/templates/91-local.py.epp
@@ -58,6 +58,22 @@ AUTHENTICATION_BACKENDS = [
     'django.contrib.auth.backends.ModelBackend',
 ]
 
+REQUIRED_ACCESS_ATTRIBUTES = [
+<% $required_access_attributes.each |$pair| { -%>
+<% $pair.each |$attribute, $value| { -%>
+  ('<%= $attribute %>', '<%= $value %>'),
+<% } -%>
+<% } -%>
+]
+
+STAFF_ATTRIBUTES = [
+<% $staff_attributes.each |$pair| { -%>
+<% $pair.each |$attribute, $value| { -%>
+  ('<%= $attribute %>', '<%= $value %>'),
+<% } -%>
+<% } -%>
+]
+
 EXPORTER_INSTALLED = [
     'slurm-job-exporter',
     'node_exporter',
diff --git a/templates/92-local_saml2.py.epp b/templates/92-local_saml2.py.epp
index 3df9cd6..9b04df2 100644
--- a/templates/92-local_saml2.py.epp
+++ b/templates/92-local_saml2.py.epp
@@ -11,3 +11,5 @@ SAML_CONFIG['service']['sp']['required_attributes'] += [
   '<%= $attribute %>',
 <% } -%>
 ]
+SAML_CONFIG['required_access_attributes'] = REQUIRED_ACCESS_ATTRIBUTES
+SAML_CONFIG['staff_attributes'] = STAFF_ATTRIBUTES