Search code examples
keycloakoidc-identity-brokering

How to map user attributes to external IDP claims in a Keycloak instance

Im using the identity brokering feature to log user through Azure AD. Im stuck when Im trying to map user attributes via the Identity provider Attribute Importer. Im pretty sure that the claim exist in the access token of Azure AD. If I try the standard sub claim it works perfectly.. Does someone know some restrictions or limitations to which claims we can import from the external access token?

Example of the external access token:

  "app_displayname": "*************",
  "appid": "*************",
  "appidacr": "1",
  "family_name": "user",
  "given_name": "user",
  "idtyp": "user",
  "ipaddr": "*************",
  "name": "user-user",
  "oid": "*************",
  "sub": "*************",
  "tenant_region_scope": "*************",
  "tid": "*************",
  "unique_name": "*************",
  "upn": "*************",
  "uti": "*************",

The Attribute Import configuration

Solution

  • I found out that I need to specify correctly the scope to include all claims from the external IDP token. In your identity provider click on Advanced link to show the scopes field. In my case the scope value is openid profile email