Keycloak retrieve custom attributes to KeycloakPrincipal

Question

In my rest service i can obtain the principal information after authentication using

KeycloakPrincipal kcPrincipal = (KeycloakPrincipal) servletRequest.getUserPrincipal();

statement.

Keycloak principal doesn't contain all the information i need about the authenticated user. Is it possible to customize my own principal type? On the keycloak-server-end I've developed a user federation provider. I saw that UserModel makes possible to add a set of custom attributes to my user.

Is it possible to insert my custom principal in that code?

Is it possible to retrieve this attributes from keycloak principal?

What is the way?

Fornication

#29015394 – Dactylography

Answer 1

To add custom attributes you need to do three things:

1. Add attributes to admin console
2. Add claim mapping
3. Access claims

The first one is explained pretty good here: https://www.keycloak.org/docs/latest/server_admin/index.html#user-attributes

Add claim mapping:

1. Open the admin console of your realm.
2. Go to Clients and open your client
3. This only works for Settings > Access Type confidential or public (not bearer-only)
4. Go to Mappers
5. Create a mapping from your attribute to json
6. Check "Add to ID token"

Access claims:

final Principal userPrincipal = httpRequest.getUserPrincipal();

if (userPrincipal instanceof KeycloakPrincipal) {

    KeycloakPrincipal<KeycloakSecurityContext> kp = (KeycloakPrincipal<KeycloakSecurityContext>) userPrincipal;
    IDToken token = kp.getKeycloakSecurityContext().getIdToken();

    Map<String, Object> otherClaims = token.getOtherClaims();

    if (otherClaims.containsKey("YOUR_CLAIM_KEY")) {
        yourClaim = String.valueOf(otherClaims.get("YOUR_CLAIM_KEY"));
    }
} else {
    throw new RuntimeException(...);
}

I used this for a custom attribute I added with a custom theme.

Oppidan

I can able to retrieve email id,GivenName,Family Name.But unable to retrieve custom attribute mobile .I'm getting OtherClaims with size 0. – Groveman

My code is: KeycloakAuthenticationToken token = (KeycloakAuthenticationToken) request. getUserPrincipal(); KeycloakPrincipal principal = (KeycloakPrincipal) token.getPrincipal(); IDToken idToken = principal.getKeycloakSecurityContext().getIdToken(); System.err.println("size "+otherClaims.size()+idToken.getEmail()+idToken.getFamilyName()); – Groveman

@SuryaMovva, have you added the mappings in keycloak administration console under the client you are using? – Vagal

@TurbutAlin Hi. I have the same problem. I cant see new attributes added to the user. I have added the mapping under my client (spring boot app) and still no new attributes are received. Could you please help? Thanks – Hubey

Link is outdated, correct one is keycloak.org/docs/latest/server_admin/… – Stander

idToken is alway null for me. i do get an access token. i can't figure out what i don't have right. suggestions? – Impeller

Answer 2

• Select Users > Lookup > click on ID > go to attributes tab > Add attribute > e.g.: phone > Save

• Select Clients > click on Client ID > go to Mappers Tab > create mapper

• Get custom attributes

UPDATE

• Add 'phone' attribute on Group level, assign user to that group, and you get 'phone' attribute from group level for all users

• Go back to mapper and update 'phone' with 'Aggregate attribute values = true' and 'Multivalued=true', and you get 'phone' as list with both attributes from group and user level. If you keep 'Aggregate attribute values = false' or 'Multivalued=false', you get just one value, where 'phone' attribute from user will override 'phone' attribute from group (which make sense)

Palatial

Thanks @Neeraj I was doing the same things you just posted. The problem on my side was the cache. After the mapping or user attribute is added, I need to clean the realm cache in Keycloak admin console. Afterwards I was able to see the attributes in otherClaims too. Hope this helps eerybody. – Hubey

@Hubey Thank you for this comment, I spent hours upon hours because I didn't think of that. – Victuals

Thank you for the solution. Is there a way to apply the custom attributes to all users? I specifically need to do this for all of my users that are imported through my Ldap provider. – Noeminoesis

Thanks for solution! Did what we wanted! Updated your answer with group attributes options – Snotty

I'm new to KeyCloak and am using latest ver 6.0.1. Your answer was such a God send - clear, concise and correct! Thanks. Kudos!! – Disappointment

@Neeraj For mobile app I want to keep device_id , device_model , latitude and longtitude when I login via RESTAPI (/openid-connect/token). Keycloak support it? – Predate

Answer 3

For Keycloak > 18 the configuration of the mappers has moved in the UI:

Inside Clients > Your selected client under the tab Client Scopes, one has to select account-dedicated:

There custom mappers can be added:

Maurinemaurise

Answer 4

For KeyCloak v25 you also have to set this config:

More details on the official docs.

Bred