{
"name": "my-user-attribute-mapper",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-attribute-mapper",
"config": {
"user.attribute": "phone_number",
"claim.name": "phone",
"jsonType.label": "String"
}
}Protocol mappers provide a flexible way to define claims used in OAuth 2.0 tokens and endpoints, and attributes in SAML 2.0 assertions. For example adding user attributes or role mappings.
This page includes a list of all built-in protocol mappers, but Keycloak also supports defining custom protocol mappers through the ProtocolMapper SPI.
Protocol mappers can be created and managed via the Keycloak REST API using the
create protocol mapper endpoint.
When creating a ProtocolMapperRepresentation, the config field is a key-value map whose available entries
depend on the specific mapper type. This page serves as a reference for the expected configuration options
available in ProtocolMapperRepresentation.config for each ProtocolMapper implementation.
For example, to create a protocol mapper that maps a user attribute into an OIDC token claim, you would send a ProtocolMapperRepresentation using the following JSON:
{
"name": "my-user-attribute-mapper",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-attribute-mapper",
"config": {
"user.attribute": "phone_number",
"claim.name": "phone",
"jsonType.label": "String"
}
}The protocolMapper field corresponds to the "ID" listed in the tables below, and the config entries are described in each mapper’s configuration table.
The same mapper can be created programmatically using the Keycloak Java admin client:
ProtocolMapperRepresentation mapper = new ProtocolMapperRepresentation();
mapper.setName("my-user-attribute-mapper");
mapper.setProtocol("openid-connect");
mapper.setProtocolMapper("oidc-usermodel-attribute-mapper");
mapper.setConfig(Map.of(
"user.attribute", "phone_number",
"claim.name", "phone",
"jsonType.label", "String"
));
Keycloak.getInstance(...)
.realm("my-realm")
.clientScopes()
.get("my-client-scope-id")
.getProtocolMappers()
.createMapper(mapper);The below table is an index of all available ProtocolMapper implementations provided by Keycloak,
grouped by the associated protocol.
| ID | Description |
|---|---|
openid-connect |
|
Adds all allowed web origins to the 'allowed-origins' claim in the token |
|
Add specified audience to the audience (aud) field of token |
|
Adds all client_ids of "allowed" clients to the audience field of the token. Allowed client means the client for which user has at least one client role |
|
Maps the achieved LoA (Level of Authentication) to the 'acr' claim of the token |
|
Add authentication method reference (AMR) to the token. |
|
Claims specified by Claims parameter are put into tokens. |
|
Claims specified by Claims parameter with value are put into an ID token. |
|
Map user group membership |
|
Hardcode a role into the access token. |
|
Hardcode a claim into the token. |
|
Adds the nonce claim to Access, Refresh and ID token |
|
Map user Organization group membership |
|
Map user Organization membership |
|
Calculates a pairwise subject identifier using a salted sha-256 hash and adds it to the 'sub' claim. See OpenID Connect specification for more info about pairwise subject identifiers. |
|
Map an assigned role to a new name or position in the token. |
|
Add Session State (session_state) claim |
|
Add Subject (sub) claim |
|
Maps user address attributes (street, locality, region, postal_code, and country) to the OpenID Connect 'address' claim. |
|
Map a custom user attribute to a token claim. |
|
Map a user client role to a token claim. |
|
Map a built in user property (email, firstName, lastName) to a token claim. |
|
Map a user realm role to a token claim. |
|
Map a custom user session note to a token claim. |
|
Maps the user’s first and last name to the OpenID Connect 'name' claim. Format is <first> + ' ' + <last> |
|
oid4vc |
|
Assigns a context to the credential. |
|
Assigns a type to the credential. |
|
Sets an ID for the credential subject, either from User ID or by attribute mapping. |
|
Assigns a generated ID to the credential’s subject. The target property can be configured, but |
|
Allows to set the issuance date credential subject. |
|
Allows to set static values for the credential subject. |
|
Map the assigned role to the credential subject, providing the client id as the target. |
|
Maps user attributes or properties to credential claims. |
|
saml |
|
Add specified audience to the audience conditions in the assertion. |
|
Adds all client_ids of "allowed" clients to the audience conditions in the assertion. Allowed client means any SAML client for which user has at least one client role |
|
Add the AuthnContextClassRef to the AuthContext with the Level of Assurance if present. |
|
Group names are stored in an attribute value. There is either one attribute with multiple attribute values, or an attribute per group name depending on how you configure it. You can also specify the attribute name i.e. 'member' or 'memberOf' being examples. |
|
Hardcode an attribute into the SAML Assertion. |
|
Hardcode role into SAML Assertion. |
|
Add attributes to the assertion with information about the organization group membership. |
|
Add an attribute to the assertion with information about the organization membership. |
|
Map a custom user attribute to a SAML attribute. |
|
Map a built in user property (email, firstName, lastName) to a SAML attribute type. |
|
Map a user session note to a SAML attribute. |
|
Map an assigned role to a new name |
|
Role names are stored in an attribute value. There is either one attribute with multiple attribute values, or an attribute per role name depending on how you configure it. You can also specify the attribute name i.e. 'Role' or 'memberOf' being examples. |
|
Map user attribute to SAML NameID value. |
|
docker-v2 |
|
Allows all grants, returning the full set of requested access attributes as permitted attributes. |
|
The following section contains all ProtocolMapper implementations associated with the openid-connect protocol. For each
implementation we provide the "ID" of the ProtocolMapper and a table describing the supported configuration properties.
Adds all allowed web origins to the 'allowed-origins' claim in the token
ID: oidc-allowed-origins-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Add specified audience to the audience (aud) field of token
ID: oidc-audience-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Included Client Audience |
|
|
None |
The Client ID of the specified audience client will be included in the audience (aud) field of the token. If the token includes audiences, the specified value is added to them. It will not override existing audiences. |
Included Custom Audience |
|
|
None |
This is used only if 'Included Client Audience' is empty. The specified value is included in the audience (aud) field of the token. If the token already contains audiences, the specified value is added to those audiences, without overriding them. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Adds all client_ids of "allowed" clients to the audience field of the token. Allowed client means the client for which user has at least one client role
ID: oidc-audience-resolve-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Maps the achieved LoA (Level of Authentication) to the 'acr' claim of the token
ID: oidc-acr-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Add authentication method reference (AMR) to the token.
ID: oidc-amr-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Claims specified by Claims parameter are put into tokens.
ID: oidc-claims-param-token-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Claims specified by Claims parameter with value are put into an ID token.
ID: oidc-claims-param-value-idtoken-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Claim name |
|
|
None |
Name of the claim you want to set its value. 'true' and 'false can be used for boolean values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Map user group membership
ID: oidc-group-membership-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Full group path |
|
|
|
Include full path to group i.e. /top/level1/level2, false will just specify the group name |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Hardcode a role into the access token.
ID: oidc-hardcoded-role-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Role |
|
|
None |
Role you want added to the token. Click 'Select Role' button to browse roles, or just type it in the textbox. To reference a client role the syntax is clientname.clientrole, i.e. myclient.myrole |
Hardcode a claim into the token.
ID: oidc-hardcoded-claim-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Claim value |
|
|
None |
Value of the claim you want to hard code. 'true' and 'false can be used for boolean values. |
Claim JSON Type |
|
|
None |
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to access token response |
|
|
|
Should the claim be added to the access token response? Should only be used for informative and non-sensitive data |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Adds the nonce claim to Access, Refresh and ID token
ID: oidc-nonce-backwards-compatible-mapper
Map user Organization group membership
ID: oidc-organization-group-membership-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Add group role mappings |
|
|
|
addGroupRoleMappings.help |
Map user Organization membership
ID: oidc-organization-membership-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Claim JSON Type |
|
|
|
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Multivalued |
|
|
|
Indicates if attribute supports multiple values. If true, the list of all values of this attribute will be set as claim. If false, just first value will be set as claim |
Add organization attributes |
|
|
|
addOrganizationAttributes.help |
Add organization id |
|
|
|
addOrganizationId.help |
Add organization domain |
|
|
|
addOrganizationDomain.help |
Calculates a pairwise subject identifier using a salted sha-256 hash and adds it to the 'sub' claim. See OpenID Connect specification for more info about pairwise subject identifiers.
ID: oidc-sha256-pairwise-sub-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Sector Identifier URI |
|
|
None |
Providers that use pairwise sub values and support Dynamic Client Registration SHOULD use the sector_identifier_uri parameter. It provides a way for a group of websites under common administrative control to have consistent pairwise sub values independent of the individual domain names. It also provides a way for Clients to change redirect_uri domains without having to reregister all their users. |
Salt |
|
|
None |
Salt used when calculating the pairwise subject identifier. If left blank, a salt will be generated. |
Map an assigned role to a new name or position in the token.
ID: oidc-role-name-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Role |
|
|
None |
Role name you want changed. Click 'Select Role' button to browse roles, or just type it in the textbox. To reference a client role the syntax is clientname.clientrole, i.e. myclient.myrole |
New Role Name |
|
|
None |
The new role name. The new name format corresponds to where in the access token the role will be mapped to. So, a new name of 'myapp.newname' will map the role to that position in the access token. A new name of 'newname' will map the role to the realm roles in the token. |
Add Session State (session_state) claim
ID: oidc-session-state-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Add Subject (sub) claim
ID: oidc-sub-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Maps user address attributes (street, locality, region, postal_code, and country) to the OpenID Connect 'address' claim.
ID: oidc-address-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
User Attribute Name for Street |
|
|
|
Name of User Attribute, which will be used to map to 'street_address' subclaim inside 'address' token claim. Defaults to 'street'. |
User Attribute Name for Locality |
|
|
|
Name of User Attribute, which will be used to map to the 'locality' subclaim inside the 'address' token claim. Defaults to 'locality'. |
User Attribute Name for Region |
|
|
|
Name of User Attribute, which will be used to map to 'region' subclaim inside 'address' token claim. Defaults to 'region'. |
User Attribute Name for Postal Code |
|
|
|
Name of User Attribute, which will be used to map to the 'postal_code' subclaim inside the 'address' token claim. Defaults to 'postal_code'. |
User Attribute Name for Country |
|
|
|
Name of User Attribute, which will be used to map to 'country' subclaim inside 'address' token claim. Defaults to 'country'. |
User Attribute Name for Formatted Address |
|
|
|
Name of the User Attribute to use for mapping to the 'formatted' subclaim inside the 'address' token claim. Defaults to 'formatted'. |
Map a custom user attribute to a token claim.
ID: oidc-usermodel-attribute-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
User Attribute |
|
|
None |
Name of stored user attribute which is the name of an attribute within the UserModel.attribute map. |
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Claim JSON Type |
|
|
None |
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Multivalued |
|
|
None |
Indicates if attribute supports multiple values. If true, the list of all values of this attribute will be set as claim. If false, just first value will be set as claim |
Aggregate attribute values |
|
|
None |
Indicates if attribute values should be aggregated with the group attributes. If using OpenID Connect mapper the multivalued option needs to be enabled too in order to get all the values. Duplicated values are discarded and the order of values is not guaranteed with this option. |
Map a user client role to a token claim.
ID: oidc-usermodel-client-role-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Client ID |
|
|
None |
Client ID for role mappings. Just client roles of this client will be added to the token. If this is unset, client roles of all clients will be added to the token. |
Client Role prefix |
|
|
None |
A prefix for each client role (optional). The special token ${client_id} can be used and this will be replaced by the actual client ID. This is useful especially when you are adding roles from all the clients (Hence 'Client ID' switch is unset) and need to present the client roles as a list, prefixed with the originating client’s client ID. |
Multivalued |
|
|
|
Indicates if attribute supports multiple values. If true, the list of all values of this attribute will be set as claim. If false, just first value will be set as claim |
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and to use the dot literally, escape the dot with a backslash (\.). You can use the special token ${client_id}; it will be replaced by the actual client ID. An example usage is 'resource_access.${client_id}.roles'. This option is especially useful when you add roles from all the clients, meaning 'Client ID' is disabled, and you want client roles of each client stored separately. |
Claim JSON Type |
|
|
None |
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Map a built in user property (email, firstName, lastName) to a token claim.
ID: oidc-usermodel-property-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Property |
|
|
None |
Name of the property method in the UserModel interface. For example, a value of 'email' would reference the UserModel.getEmail() method. |
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Claim JSON Type |
|
|
None |
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Map a user realm role to a token claim.
ID: oidc-usermodel-realm-role-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Realm Role prefix |
|
|
None |
A prefix which will be prepended to each Realm Role name (optional). |
Multivalued |
|
|
|
Indicates if attribute supports multiple values. If true, the list of all values of this attribute will be set as claim. If false, just first value will be set as claim |
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Claim JSON Type |
|
|
None |
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Map a custom user session note to a token claim.
ID: oidc-usersessionmodel-note-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
User Session Note |
|
|
None |
Name of stored user session note within the UserSessionModel.note map. |
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
Claim JSON Type |
|
|
None |
JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values. |
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to access token response |
|
|
|
Should the claim be added to the access token response? Should only be used for informative and non-sensitive data |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
Maps the user’s first and last name to the OpenID Connect 'name' claim. Format is <first> + ' ' + <last>
ID: oidc-full-name-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add to ID token |
|
|
|
Should the claim be added to the ID token? |
Add to access token |
|
|
|
Should the claim be added to the access token? |
Add to lightweight access token |
|
|
|
Should the claim be added to the lightweight access token? |
Add to userinfo |
|
|
|
Should the claim be added to the userinfo? |
Add to token introspection |
|
|
|
Should the claim be added to the token introspection? |
The following section contains all ProtocolMapper implementations associated with the oid4vc protocol. For each
implementation we provide the "ID" of the ProtocolMapper and a table describing the supported configuration properties.
Assigns a context to the credential.
ID: oid4vc-context-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Verifiable Credentials Context |
|
|
Context of the credential. |
Assigns a type to the credential.
ID: oid4vc-vc-type-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Verifiable Credential Type |
|
|
None |
Type of the credential. |
Sets an ID for the credential subject, either from User ID or by attribute mapping.
ID: oid4vc-subject-id-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Token Claim Name |
|
|
|
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In case that 'id' is used as a value of this configuration property, it would be mapped into sd-jwt credential as claim 'sub'. |
User attribute |
|
|
|
The name of the user attribute that maps to the subject id. |
Assigns a generated ID to the credential’s subject. The target property can be configured, but id is used by default.
ID: oid4vc-generated-id-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
ID Property Name |
|
|
|
Name of the property to contain the generated id. |
Allows to set the issuance date credential subject.
ID: oid4vc-issued-at-time-claim-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Time Claim Name |
|
|
|
Name of this time claim. Default is iat |
Truncate To Time Unit |
|
|
None |
Truncate time to the start of the selected unit. Supported: SECONDS, MINUTES, HOURS, HALF_DAYS, DAYS, WEEKS, MONTHS, YEARS. Such as to prevent correlation of credentials based on this time value. |
Source of Value |
|
|
|
Tells the protocol mapper where to get the information. For now: COMPUTE or VC. Default is COMPUTE, in which this protocol mapper computes the current time in seconds. With value |
Allows to set static values for the credential subject.
ID: oid4vc-static-claim-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Static Claim Property Name |
|
|
None |
Name of the property to contain the static value. |
Static Claim Value |
|
|
None |
Value to be set for the property. |
Map the assigned role to the credential subject, providing the client id as the target.
ID: oid4vc-target-role-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Client ID |
|
|
|
Property to configure the client to get the roles from. |
Maps user attributes or properties to credential claims.
ID: oid4vc-user-attribute-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Mandatory Claim |
|
|
|
Indicates whether this claim must be present in the issued credential. This information is included in the credential metadata for wallet applications. |
Claim Display Information |
|
|
None |
Display metadata for wallet applications to show user-friendly claim names. Provide display entries with name and locale for internationalization support. |
Token Claim Name |
|
|
None |
Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\.). |
User Attribute |
|
|
None |
Name of stored user attribute which is the name of an attribute within the UserModel.attribute map. |
Aggregate attributes |
|
|
None |
Should the mapper aggregate user attributes. |
The following section contains all ProtocolMapper implementations associated with the saml protocol. For each
implementation we provide the "ID" of the ProtocolMapper and a table describing the supported configuration properties.
Add specified audience to the audience conditions in the assertion.
ID: saml-audience-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Included Client Audience |
|
|
None |
The Client ID of the specified audience client will be included in the audience (aud) field of the token. If the token includes audiences, the specified value is added to them. It will not override existing audiences. |
Included Custom Audience |
|
|
None |
This is used only if 'Included Client Audience' is empty. The specified value is included in the audience (aud) field of the token. If the token already contains audiences, the specified value is added to those audiences, without overriding them. |
Adds all client_ids of "allowed" clients to the audience conditions in the assertion. Allowed client means any SAML client for which user has at least one client role
ID: saml-audience-resolve-mapper
Add the AuthnContextClassRef to the AuthContext with the Level of Assurance if present.
ID: saml-authn-context-class-ref-mapper
Group names are stored in an attribute value. There is either one attribute with multiple attribute values, or an attribute per group name depending on how you configure it. You can also specify the attribute name i.e. 'member' or 'memberOf' being examples.
ID: saml-group-membership-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Group attribute name |
|
|
|
Name of the SAML attribute you want to put your groups into. i.e. 'member', 'memberOf'. |
Friendly Name |
|
|
None |
Standard SAML attribute setting. An optional, more human-readable form of the attribute’s name that can be provided if the actual attribute name is cryptic. |
SAML Attribute NameFormat |
|
|
None |
SAML Attribute NameFormat. Can be basic, URI reference, or unspecified. |
Single Group Attribute |
|
|
|
If true, all groups will be stored under one attribute with multiple attribute values. |
Full group path |
|
|
|
Include full path to group i.e. /top/level1/level2, false will just specify the group name |
Hardcode an attribute into the SAML Assertion.
ID: saml-hardcode-attribute-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Friendly Name |
|
|
None |
Standard SAML attribute setting. An optional, more human-readable form of the attribute’s name that can be provided if the actual attribute name is cryptic. |
SAML Attribute Name |
|
|
None |
SAML Attribute Name |
SAML Attribute NameFormat |
|
|
None |
SAML Attribute NameFormat. Can be basic, URI reference, or unspecified. |
Attribute value |
|
|
None |
Value of the attribute you want to hard code. |
Hardcode role into SAML Assertion.
ID: saml-hardcode-role-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Role |
|
|
None |
Arbitrary role name you want to hardcode. This role does not have to exist in current realm and can be just any string you need |
Add attributes to the assertion with information about the organization group membership.
ID: saml-organization-group-membership-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Add group role mappings |
|
|
|
addGroupRoleMappings.help |
Add an attribute to the assertion with information about the organization membership.
ID: saml-organization-membership-mapper
Map a custom user attribute to a SAML attribute.
ID: saml-user-attribute-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
User Attribute |
|
|
None |
Name of stored user attribute which is the name of an attribute within the UserModel.attribute map. |
Friendly Name |
|
|
None |
Standard SAML attribute setting. An optional, more human-readable form of the attribute’s name that can be provided if the actual attribute name is cryptic. |
SAML Attribute Name |
|
|
None |
SAML Attribute Name |
SAML Attribute NameFormat |
|
|
None |
SAML Attribute NameFormat. Can be basic, URI reference, or unspecified. |
Aggregate attribute values |
|
|
None |
Indicates if attribute values should be aggregated with the group attributes. If using OpenID Connect mapper the multivalued option needs to be enabled too in order to get all the values. Duplicated values are discarded and the order of values is not guaranteed with this option. |
Map a built in user property (email, firstName, lastName) to a SAML attribute type.
ID: saml-user-property-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Property |
|
|
None |
Name of the property method in the UserModel interface. For example, a value of 'email' would reference the UserModel.getEmail() method. |
Friendly Name |
|
|
None |
Standard SAML attribute setting. An optional, more human-readable form of the attribute’s name that can be provided if the actual attribute name is cryptic. |
SAML Attribute Name |
|
|
None |
SAML Attribute Name |
SAML Attribute NameFormat |
|
|
None |
SAML Attribute NameFormat. Can be basic, URI reference, or unspecified. |
Map a user session note to a SAML attribute.
ID: saml-user-session-note-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
User Session Note Attribute |
|
|
None |
The user session note you want to grab the value from. |
Friendly Name |
|
|
None |
Standard SAML attribute setting. An optional, more human-readable form of the attribute’s name that can be provided if the actual attribute name is cryptic. |
SAML Attribute Name |
|
|
None |
SAML Attribute Name |
SAML Attribute NameFormat |
|
|
None |
SAML Attribute NameFormat. Can be basic, URI reference, or unspecified. |
Map an assigned role to a new name
ID: saml-role-name-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Role |
|
|
None |
Role name you want changed. Click 'Select Role' button to browse roles, or just type it in the textbox. To reference a client role the syntax is clientname.clientrole, i.e. myclient.myrole |
New Role Name |
|
|
None |
The new role name. |
Role names are stored in an attribute value. There is either one attribute with multiple attribute values, or an attribute per role name depending on how you configure it. You can also specify the attribute name i.e. 'Role' or 'memberOf' being examples.
ID: saml-role-list-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
Role attribute name |
|
|
|
Name of the SAML attribute you want to put your roles into. i.e. 'Role', 'memberOf'. |
Friendly Name |
|
|
None |
Standard SAML attribute setting. An optional, more human-readable form of the attribute’s name that can be provided if the actual attribute name is cryptic. |
SAML Attribute NameFormat |
|
|
None |
SAML Attribute NameFormat. Can be basic, URI reference, or unspecified. |
Single Role Attribute |
|
|
|
If true, all roles will be stored under one attribute with multiple attribute values. |
Map user attribute to SAML NameID value.
ID: saml-user-attribute-nameid-mapper
| Name | Property | Type | Default | Description |
|---|---|---|---|---|
name-id-format |
|
|
None |
This mapper is applied only if the NameID format of the incoming AuthnRequest is equal to this value. |
User Attribute |
|
|
None |
Name of stored user attribute which is the name of an attribute within the UserModel.attribute map. |