[keycloak-user] customizable attribute mapper

Hynek Mlnarik hmlnarik at redhat.com
Fri Oct 6 08:22:33 EDT 2017


It's not there yet. Similar functionality has already been requested
in [1]. Could you please comment on your use expected case there and
if interested, vote for it?

Thanks

--Hynek

[1] https://issues.jboss.org/browse/KEYCLOAK-4781

On Fri, Oct 6, 2017 at 2:01 PM, Jonas Weismueller <jw at blue-yonder.com> wrote:
> Hi,
>
> we are still evaluating keycloak vs. simplesamlphp.
>
> What we find quite convenient using simplesamlphp is this authentication
> processing attributealter possibility:
>
> https://simplesamlphp.org/docs/stable/core:authproc_attributealter
>
> Using this especially with the feature to be able to use regex pattern
> matching it is quite easy to combine/construct certain SAML attributes
> in the way the SP needs it.
>
> For example we could add a fixed top level domain to the IDPEmail
> Attribute, where the SP needs it in the syntax username at domain.tld
> instead of username as retrieved by our LDAP backend system.
>
> One real example from our current simplesamlphp configuration:
>
> 30 => array(
>      'class' => 'core:AttributeAlter',
>      'subject' => 'uid',
>      'pattern' => '/([a-z]+)/',
>      'replacement' => '\1 at domain.tld',
>      'target' => 'IDPEmail',
> ),
>
>
> I could not find any similar feature within keycloak or did I just
> overseen it?
>
> Cheers Jonas
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 

--Hynek


More information about the keycloak-user mailing list