Re: [keycloak-user] SAML Custom Attribute NameID

Hi, Currently, KeyCloak doesn't support this feature. We end up implementing a custom protocol mapper to support this feature. It is something like this. public class SAMLLoginResponseMapperExtension extends AbstractSAMLProtocolMapper implements SAMLLoginResponseMapper { ................... public ResponseType transformLoginResponse(ResponseType response, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionModel clientSession) { // if the attributeName is configured, read the value from the user // model String attributeName = mappingModel.getConfig().get(NAME_ID_USER_ATTRIBUTE); if (StringUtils.isNotBlank(attributeName)) { UserModel user = userSession.getUser(); if (StringUtils.indexOfAny(attributeName, new String[] { "firstName", "lastName", "username" }) != -1) { attributeValue = ProtocolMapperUtils.getUserModelValue(user, attributeName); } else { attributeValue = KeycloakModelUtils.resolveFirstAttribute(user, attributeName); } } for (RTChoiceType rtChoiceType : response.getAssertions()) { NameIDType nameIDType = (NameIDType) rtChoiceType.getAssertion().getSubject().getSubType().getBaseID(); nameIDType.setValue(attributeValue); } return response; } .................. } Regards, Muein On Wed, Mar 1, 2017 at 5:23 PM, Adam Keily <adam.keily(a)adelaide.edu.au&gt; wrote: