Mapping a claim from a brokered IdP #24945

blevine · 2023-11-22T22:22:43Z

blevine
Nov 22, 2023

Hello all,

I'm delegating authentication from a Keycloak client to another OIDC IdP. That IdP sends back a list of groups in a "groups" claim. I'd like to expose that as a "groups" claim returned from the Keycloak client so that it appears in the id/access token. Is there a way to accomplish that? I didn't see an IdP mapper that would do that.

Thanks!

danielFesenmeyer · 2023-11-23T09:27:55Z

danielFesenmeyer
Nov 23, 2023

I think we had a similar use case, which has been discussed here: #14607

As a result, we have implemented a "Claim to User Session Note Idp Mapper". It allows to include an IDP claim (such as "groups") into a user session note.
You can then define a "User Session Note" mapper on your client, which writes the user session note as claim into the client token.

3 replies

PacDDrake Feb 13, 2024

I am having some trouble doing this as suggested:

The "Claim to User Session Note IdP Mapper" apparently cannot handle anything other than String values.
In my case, groups are stored as an array in the claim: {"groups": [group1, group2, group3]}

When logging in using the OIDC IdP, Keycloak throws the following warning in the console:
[org.keycloak.broker.oidc.mappers.ClaimToUserSessionNoteMapper] (executor-thread-12) Claim 'groups' does not contain a string value for user with brokerUserId 'external-idp.9684d194-b2b2-498a-a1a1-57bb5a1419d8'. Actual value is of type 'class java.util.ArrayList': [group1, grou2, group3]

Is there a known way to deal with non-String types in the "Claim to User Session Note IdP Mapper"?

PacDDrake Feb 13, 2024

Addendum:
I have implemented a solution using the "Attribute Importer" IdP Mapper and "User Attribute" Client Mapper.
Essentially I am importing the claim from the IdP as user attributes, which I later map into the issued tokens on a client level.
This seems to work for updating groups so long as the sync mode on the mappers and IdP are set to "force".

Unfortunately I have not been able to make the Session Note Mappers work.

danielFesenmeyer Feb 13, 2024

You are right, it currently just seems to work for claim values of type "string".

I think the reason for the current implementation is that session notes have to be of type String. It would probably be better when the ClaimToUserSessionNoteMapper would not be restricted to claims of claim "string" - instead the mapper could allow all claims and serialize those as (JSON) string.
However, with this approach, the UserSessionNoteMapper would have to be explicitly configured to map the value as "JSON" (instead of the "String" default).

blevine · 2023-11-23T13:20:48Z

blevine
Nov 23, 2023
Author

Thank you!

0 replies

blevine · 2023-11-25T17:02:08Z

blevine
Nov 25, 2023
Author

Just to keep things "simpler", I might take a shot at writing my own custom mapper that just maps selected claims directly.

1 reply

danielFesenmeyer Nov 27, 2023

Definitely simpler for users, but unsure whether it's that simple to implement.
Would be great to hear whether that approach works fine for you.

bkaney · 2025-04-18T18:26:23Z

bkaney
Apr 18, 2025

I just came up with this workaround, documenting here in case someone needs it.

In the Claim to User Session Note IdP Mapper, create an item for each entry in the JSON, regardless of nesting. Use the item.child syntax for the claim key.
In the client User Session Note scope mapper, use the same nesting item.child dot-notation for both the User Session Note and Token Claim Value.

8000

0 replies

Mapping a claim from a brokered IdP #24945

Uh oh!

Uh oh!

blevine Nov 22, 2023

Replies: 4 comments · 4 replies

Uh oh!

danielFesenmeyer Nov 23, 2023

Uh oh!

PacDDrake Feb 13, 2024

Uh oh!

Uh oh!

PacDDrake Feb 13, 2024

Uh oh!

danielFesenmeyer Feb 13, 2024

Uh oh!

blevine Nov 23, 2023 Author

Uh oh!

blevine Nov 25, 2023 Author

Uh oh!

danielFesenmeyer Nov 27, 2023

Uh oh!

bkaney Apr 18, 2025

blevine
Nov 22, 2023

Replies: 4 comments 4 replies

danielFesenmeyer
Nov 23, 2023

blevine
Nov 23, 2023
Author

blevine
Nov 25, 2023
Author

bkaney
Apr 18, 2025