How keycloak sets up user information from an external identity provider

1
votes

During use, I found that keycloak automatically registers a new user in the local database after obtaining the user information of the external identity provider(Azure AD).Can the user's username be consistent with the user information of the external identity provider(Azure AD) in some way? For example, the username of the newly registered user is automatically set to the user mailbox of the external identity provider(Azure AD)?

ps:keycloak 7.0.1 windows10

1
azure-active-directorykeycloak

1 Answers

2
votes

use identity privider mapper.

For email the mapper is of type Attribute Importer. Map the user attribute email to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

For username the mapper is of type Username Template Importer. Map the user attribute username to ${ATTRIBUTE.http://schemas.microsoft.com/2012/12/certificatecontext/field/subjectname}.

For surname the mapper is of type Attribute Importer. Map the user attribute lastName to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname.

For given name the mapper is of type Attribute Importer. Map the user attribute firstName to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname.