How to configure WSO2 Identity Server to add claim from second user store

Question

At the moment we use WSO2IS with OpenLDAP user store in which we have users with some custom attributes. WSO2IS is configured to return those custom attributes as claims in OpenID Connect token.

Now we want to install our application (including WSO2IS/OpenLDAP) to a new client which has its own Active Directory. This client wants for its users to be able to login using credentials stored in AD, but we are not allowed to put our custom attributes into client's AD.

Is it possible to configure WSO2IS so users are authenticated through Active Directory but generated OpenID Connect token gets claims from separate OpenLDAP store?

Answer 1

Unfortunately this is not possible out of the box. But you can write a custom user store [1] to do this. You can write a custom user store to use with the AD and in there, after the user authentication you can retrieve claims from the secondary user store.

[1] https://docs.wso2.com/display/IS500/Writing+a+Custom+User+Store+Manager