<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:Consolas;
color:black;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.E-MailFormatvorlage21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.E-MailFormatvorlage22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.E-MailFormatvorlage23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1376583749;
mso-list-type:hybrid;
mso-list-template-ids:1060294300 67567633 67567641 67567643 67567631 67567641 67567643 67567631 67567641 67567643;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Hi Marek,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">I think what we want is a composition of both options. Something like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">[…]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">“additional_info”: {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> “departments”: {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> “finance”,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> “development”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> },<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> “organization”: “ABC”
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">}<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">[...]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">I take a look at the AccessTokenTest where multiple values of the same attribute are mapped to an array in the accessToken. This is fine, but how can I configure multiple values for one attribute?
The first value is always overwritten.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">sascha<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="color:windowtext;mso-fareast-language:DE">Von:</span></b><span style="color:windowtext;mso-fareast-language:DE"> Marek Posolda [mailto:mposolda@redhat.com]
<br>
<b>Gesendet:</b> Donnerstag, 22. </span><span lang="EN-US" style="color:windowtext;mso-fareast-language:DE">Oktober 2015 21:52<br>
<b>An:</b> Sascha Skorupa <sascha.skorupa@traveltainment.de>; keycloak-user@lists.jboss.org<br>
<b>Betreff:</b> Re: [keycloak-user] Multivalued user attributes mapping<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">On 22/10/15 16:46, Sascha Skorupa wrote:</span><span lang="EN-US" style="font-size:12.0pt;mso-fareast-language:DE"><o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Hi,</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">if this is currently not possible what does the “Multivalued” flag mean in the mappers section of a client?</span><span lang="EN-US"><o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE">It is used if your user has multiple values of same attribute. For example user "john" works in 2 departments "finance" and "development",
so attribute "department" of user "john" has 2 values in model - "finance" and "development" .
<br>
So when "multivalued" is on, then both values of the attribute will be propagated to accessToken and they will be available in accessToken in list (array). However when "multivalued" is off, then just single value of attribute is propagated to accessToken and
it's available in accessToken as String (or any other simple type).<br>
<br>
>From what I understood, your usecase is that you have 2 different attributes on UserModel and you want to map them into single attribute in accessToken. For example you have attribute "department" with value "finance" and attribute "secondaryDepartment" with
value "development" and you want them both to be mapped into accessToken into single attribute "department" with 2 values "finance" and "development" . Is it correct?
<br>
<br>
That's what we don't have and you may write custom protocol mapper for it.<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Is there any example / documentation how to implement and integrate custom protocol mappers?
</span><span lang="EN-US"><o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE">Looks we don't have example for protocol mapper, but we have some examples for other providers. See the example distribution and it's
subdirectory "providers" . <br>
<br>
Marek<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Cheers</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">sascha</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="color:windowtext;mso-fareast-language:DE">Von:</span></b><span style="color:windowtext;mso-fareast-language:DE"> Marek Posolda [</span><a href="mailto:mposolda@redhat.com"><span style="mso-fareast-language:DE">mailto:mposolda@redhat.com</span></a><span style="color:windowtext;mso-fareast-language:DE">]
<br>
<b>Gesendet:</b> Montag, 21. </span><span lang="EN-US" style="color:windowtext;mso-fareast-language:DE">September 2015 14:32<br>
<b>An:</b> Sascha Skorupa </span><a href="mailto:sascha.skorupa@traveltainment.de"><span lang="EN-US" style="mso-fareast-language:DE"><sascha.skorupa@traveltainment.de></span></a><span lang="EN-US" style="color:windowtext;mso-fareast-language:DE">;
</span><a href="mailto:keycloak-user@lists.jboss.org"><span lang="EN-US" style="mso-fareast-language:DE">keycloak-user@lists.jboss.org</span></a><span lang="EN-US" style="color:windowtext;mso-fareast-language:DE"><br>
<b>Betreff:</b> Re: [keycloak-user] Multivalued user attributes mapping</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">On 21/09/15 11:52, Sascha Skorupa wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">we are currently evaluating Keycloak as IDM solution for our company. In doing so we encountered the following questions according to storing authorization data:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo2"><![if !supportLists]><span lang="EN-US"><span style="mso-list:Ignore">1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US">In the “Mapper” section it is possible to configure how user attributes are mapped to tokens/claims. It is also possible to turn on “Multivalued” mapping, so that every value of one attribute is set as claim.
But, how you can configure multiple values for one attribute? If you save another value with the same key the existing one is overwritten.<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt">You mean to map multiple different attributes from User into one attribute of AccessToken? That's not possible with the existing mappers . The thing is that you can write your own protocol mapper
implementation and map the claims exactly how you want.<br>
<br>
<br>
</span><span lang="EN-US"><o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo2"><![if !supportLists]><span lang="EN-US"><span style="mso-list:Ignore">2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US">One of requirements is to persist custom authorization data hierarchically and to map this data into access tokens. Is there any recommendation how to realize this in keycloak or is the only way to use flat
user attributes (key/value).<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt">The accessToken has "otherClaims" map on it. You can use any hierarchy you want to map your stuff into the access token. The best is again to write your own protocol mapper to achieve exactly
what you want.<br>
<br>
Marek<br>
<br>
<br>
</span><span lang="EN-US"><o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks, Sascha<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt"><br>
<br>
<br>
<br>
</span><span lang="EN-US"><o:p></o:p></span></p>
<pre><span lang="EN-US">_______________________________________________<o:p></o:p></span></pre>
<pre><span lang="EN-US">keycloak-user mailing list<o:p></o:p></span></pre>
<pre><a href="mailto:keycloak-user@lists.jboss.org"><span lang="EN-US">keycloak-user@lists.jboss.org</span></a><span lang="EN-US"><o:p></o:p></span></pre>
<pre><a href="https://lists.jboss.org/mailman/listinfo/keycloak-user"><span lang="EN-US">https://lists.jboss.org/mailman/listinfo/keycloak-user</span></a><span lang="EN-US"><o:p></o:p></span></pre>
</blockquote>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><br>
<br>
<br>
<o:p></o:p></span></p>
<pre><span lang="EN-US">_______________________________________________<o:p></o:p></span></pre>
<pre><span lang="EN-US">keycloak-user mailing list<o:p></o:p></span></pre>
<pre><a href="mailto:keycloak-user@lists.jboss.org"><span lang="EN-US">keycloak-user@lists.jboss.org</span></a><span lang="EN-US"><o:p></o:p></span></pre>
<pre><a href="https://lists.jboss.org/mailman/listinfo/keycloak-user"><span lang="EN-US">https://lists.jboss.org/mailman/listinfo/keycloak-user</span></a><span lang="EN-US"><o:p></o:p></span></pre>
</blockquote>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><o:p> </o:p></span></p>
</div>
</body>
</html>