Azure Ad as OIDC Identity provider in keycloak, but a random UUId is added as IDP "userid" and not able to sync with the already existing user

user_9033617 0
Viewed 1260

I have configured keycloak with azure ad as OIDC identity provider. When i login from my webapp, i get redirect to microsoft login page. After this login i see that i am automatically added as a user in keycloak. I see that keycloak uses specific identity provider Id and Identity provider username to do a match, i see that email is populated as identity provider username but i see a random UUID is populated as identity provider Id, I am unable to figure out how these values are populated and i cannot find this identity provider ID in Azure AD.

If i already have a user with same email id in keycloak when i login i am not able to create this user and it does not automatically sync this user.

I could not find any way that i can see the response sent from azure AD. let me know a way we can check this response from azure AD.

Any help would be greatly appreciable.

keycloak azure-active-directory openid-connect azure
1 Answers

This is not a random UUID it's sub value in the ID token that is returned from the IDP. To understand what exactly is happening here we need to dive a bit deep into it.

By default if you don't provide a value for the User Info URL or you have checked the Disable User info it'll look at the ID token received and will take the sub value from the token as the username for the local keycloak user. If you have provided a valid user info endpoint it'll first check if the email value is present in the user info endpoint and if it's present it'll take that value and if it's not present it'll default back sub value in the user info endpoint.

User info endpoint response

If you want something other than email to be taken as the username eg :- UPN you will then have to create a claim in the your IDP in this case Azure and add that claim to the ID token. Azure Claim Creation

Now you need to create a claim mapper in the keycloak side to match the value in claim to an attribute/UserEntityModel in keycloak. Keycloak claim mapper

Once all these steps are done you should be good to go, you can reefer the following links to learn more about Keycloak mappers and Azure Claim mappings.

https://www.keycloak.org/docs/latest/server_admin/#_mappers

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims

user_85436490
Related