Re: [keycloak-user] SAML attribute mapping debugging

Bump. I saw someone had a previous question in October about IdP mappings but the thread died without clear resolution. I didn’t see any general information on enabling DEBUG mode in keycloak to help with troubleshooting. When I log into the “account” client application via SAML, I’m presented with a screen to enter in my login, email, first name and last name so I can see that none of the values in the SAML assertion are being picked up by the mappers. -Jason From: <keycloak-user-bounces@lists.jboss.org<mailto:keycloak-user-bounces@lists.jboss.org>> on behalf of Jason Axley <jaxley@expedia.com<mailto:jaxley@expedia.com>> Date: Thursday, February 18, 2016 at 1:49 PM To: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>" <keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>> Subject: [keycloak-user] SAML attribute mapping debugging I’ve set up incoming SAML authentication using Microsoft ADFS as the IdP. However, the attribute mappings I’ve configured are not picking up the data. A couple things are not clear: 1. How can one debug the mappings to find out why they did not find the data? 2. Where is the “user model” documented to know which fields are available to map to? I pulled out some things from existing LDAP mappings but would be nice to know what else is there to map (e.g. AD or other LDAP Groups) For example, I’ve set up an email mapper that is configured: Mapper Type: Attribute Importer Attribute Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress Friendly Name: emailaddress User Attribute Name: email Doesn’t work… -Jason