Repository navigation
ADD CUSTOM CLAIMS DYNAMICALLY #17279
Replies: 1 comment 10 replies
|
You can implement your own custom SPI public class MyCustomOIDCProtocolMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper {
public static final String PROVIDER_ID = "oidc-custom-protocol-mapper";
private static final List<ProviderConfigProperty> configProperties = new ArrayList<>();
@Override
public List<ProviderConfigProperty> |
|
I don't really get how dynamic this value is. The claim is typically for some form of authorization so it can't be that any client can put any value there without some form of validation. So then for each value you would create a scope. And for each scope you would have a hardcoded claim mapper with the value. Then for each eligible client you would configure the scopes it can set. |
|
Well, with Authorization Code Grant, it's entirely possible to write a custom implementation of The thing here is different in a sense that I am talking about Client Credentials Grant, which to my understanding, does not provide a mean to override used |
|
I'm still not really sure about your use case. It could be that you need something like RFC 9396 OAuth 2.0 Rich Authorization Requests with the Then your scope parameter can be In your custom @Override
protected void setClaim(final IDToken token,
final ProtocolMapperModel mappingModel,
final UserSessionModel userSession,
final KeycloakSession keycloakSession,
final ClientSessionContext clientSessionCtx) {
clientSessionCtx.getScopeString(); // returns "mycustomscope:some-dynamic-value-the-token-obtainer-can-define"
} |
|
Thanks @justin-tay that was exactly what I was looking for! |
|
Sorry for the delayed repost but does this work for you? I have dynamic scopes set up in Keycloak 26.3.2 however in my custom |
Uh oh!
There was an error while loading. Please reload this page.
Hello,
Currently I am using a technical account to generate token from keycloack.
Then I need to add additional information to the generated token from the connected user. (for specefic needs, we can't declare the user in the keycloak users, that's why we pass by a technical account)
Those piece of information are dynamically constructed (based on the connected user who ordered the token generation)
I found this documentation :
If you want to add a custom claim to a Keycloak token when a user is authenticated, you can use the Keycloak REST API to modify the user's token. Specifically, you can use the /auth/realms/{realm}/protocol/openid-connect/token endpoint to request a new token with custom claims included. Here's an example of how to use the Keycloak REST API to add a custom claim to a user's token: First, you'll need to authenticate the user and obtain an access token. This can be done using the Keycloak authentication API, for example, by redirecting the user to the Keycloak login page or using the Resource Owner Password Credentials grant. The access token will be included in the response from Keycloak. Once you have the access token, you can use it to make a request to the /auth/realms/{realm}/protocol/openid-connect/token endpoint to request a new token with custom claims. The request should include the following parameters: grant_type: This should be set to refresh_token. client_id: The ID of the client application that the token is being requested for. refresh_token: The refresh token obtained in step 1. scope: The scope of the new token, which can include any additional scopes required by the client application. custom_claims: A JSON object containing the custom claims to be added to the token.But It doesn't work.
My Question is there a solution to add dynamic information to the token via api?
Thank you very much
All reactions