Azure AD does not sends claims info in Id or Access tokens

Question

I'm trying to connect Azure ActiveDirectory with Keycloak using OpenID Connect v1.0 protocol.

I connected Keycloak and I can login with azure account in Keycloak, but I can't pass any optional claims to my id or access tokens. They have only standard fields. On the frontend side I'm checking the /token path after login.

In my Manifest i see optional claims in both tokens. I gave all possible accesses to claims on security tab but all without success.

Can you please give me a tipp, how can i solve this? What should i look/check? I need to transfer roles/groups from azure account to my Keycloak and map them.

Answer 1

For optional claims or attributes to be present in Id token or access token ,

Check the added optional claims in Azure AD for the application.

In the keycloak , create the mappers to reflect in Id token or access token.

• In the realm in keycloak , go to Clients in the dashboard and select your client.
• Navigate to 'Mappers' label and click 'Create'.

Then for example mapper type can be of 'User Attribute' or Attributr importer for different Identity provider.

If that is selected , then fill the attribute name that user actually has when authenticates and select the appropriate option , if it is to be included in any of ID token, access token and userinfo.

---

In case of mapping from another IDP i.e; here Azure AD

refer this sample for okta

For example If upn is selected for optional claim in AzureAD:

From Identiy Providers blade , select mappers and use attribute importer for mapper type.

References:

1. Server Administration Guide -protocol mappers (keycloak.org)
2. azure-ad-as-oidc-identity-provider-in-keycloak | | StackOverflow