I figured it out. I needed to add a mapper in order to get the email. Thank you. From: Stian Thorgersen <sthorger(a)redhat.com&gt; Reply-To: &quot;stian(a)redhat.com&quot; <stian(a)redhat.com&gt; Date: Wednesday, December 14, 2016 at 12:55 AM To: Reed Lewis <RLewis(a)carbonite.com&gt; Cc: &quot;keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; Subject: Re: [keycloak-user] Using Keycloak with Microsoft Azure Active Directory So the issue is that you're missing the email address? You probably just need to tweak the scope setting on the provider (try adding email) On 9 December 2016 at 14:07, Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote: I am attempting to use Microsoft Azure Active Directory with Keycloak. It is not working correctly. Here is how I have it configured: OpenID Connect V1.0 Enabled: On Store Tokens: On Store Tokens Readable: On Trust Email: On Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize Token URL: https://login.microsoftonline.com/common/oauth2/token Logout URL: <none> Backchannel Logout: Off User Info URL: <blank> First Login Flow: First Broker Login It directs me to the Microsoft page to login correctly, but when it comes back to keycloak, it either only has the first and last name, but no email address. Is there something I have configured incorrectly? I also tried to use the built in Microsoft connector, but that does not work with Azure Active Directory. Thank you, Reed Lewis _______________________________________________ keycloak-user mailing list keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi, I try to summarize, what we did: 1.    Download https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationm... and import as client in your realm. 2.    Edit Client   a.    Settings: Disable Client Signature Required and set Signature Algorithm to “RSA_SHA1”   b.    Mapper: Name: IDPEmail, Mapper Type: User Property, Property: email, SAML Attribute Name: IDPEmail 3.    Currently we use local user database   a.    Add user   b.    Attributes: add/change key “saml.persistent.name.id.for.urn:federation:MicrosoftOnline” to “$foo” <- $foo must be the value of the ImmutableId attribute of the user synchronized to Azure AD. On Azure site we followed the instruction on the website: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-di... With Powershell we changed the authentication domain to be federated: $cer=" " <- get the public key certificate from keycloak https://keycloak-host.tld /auth/realms/Azure/protocol/saml/descriptor, see X509Certificate $uri="https://keycloak-host.tld/auth/realms/Azure/protocol/saml" $issuer_uri="https://keycloak-host.tld /auth/realms/Azure" $dom="<your-authentication-domain.tld>" Set-MsolDomainAuthentication -DomainName $dom  -Authentication Federated -ActiveLogOnUri $uri -SigningCertificate $cer -PassiveLogOnUri $uri -IssuerUri $issuer_uri -LogOffUri $uri -PreferredAuthenticationProtocol SAMLP You can verify the settings via: Get-MsolDomainFederationSettings -DomainName "<your-authentication-domain.tld>" If you want to change the settings, you have to set the domain back to managed first: Set-MsolDomainAuthentication -DomainName "<your-authentication-domain.tld>" -Authentication Managed The federation change of the domain might take up to 72 hours until properly applied. Hope this helps Cheers Jonas On 31.08.17 14:15, songokudbz wrote: