Keycloak retrieve custom attributes to KeycloakPrincipal

Question

In my rest service i can obtain the principal information after authentication using

KeycloakPrincipal kcPrincipal = (KeycloakPrincipal) servletRequest.getUserPrincipal();

statement.

Keycloak principal doesn't contain all the information i need about the authenticated user. Is it possible to customize my own principal type? On the keycloak-server-end I've developed a user federation provider. I saw that UserModel makes possible to add a set of custom attributes to my user.

Is it possible to insert my custom principal in that code?

Is it possible to retrieve this attributes from keycloak principal?

What is the way?

Solution 1

To add custom attributes you need to do three things:

1. Add attributes to admin console
2. Add claim mapping
3. Access claims

The first one is explained pretty good here: https://www.keycloak.org/docs/latest/server_admin/index.html#user-attributes

Add claim mapping:

1. Open the admin console of your realm.
2. Go to Clients and open your client
3. This only works for Settings > Access Type confidential or public (not bearer-only)
4. Go to Mappers
5. Create a mapping from your attribute to json
6. Check "Add to ID token"

Access claims:

final Principal userPrincipal = httpRequest.getUserPrincipal();

if (userPrincipal instanceof KeycloakPrincipal) {

    KeycloakPrincipal<KeycloakSecurityContext> kp = (KeycloakPrincipal<KeycloakSecurityContext>) userPrincipal;
    IDToken token = kp.getKeycloakSecurityContext().getIdToken();

    Map<String, Object> otherClaims = token.getOtherClaims();

    if (otherClaims.containsKey("YOUR_CLAIM_KEY")) {
        yourClaim = String.valueOf(otherClaims.get("YOUR_CLAIM_KEY"));
    }
} else {
    throw new RuntimeException(...);
}

Hope this helps and fits your use case. I used this for a custom attribute I added with a custom theme.

Solution 2

• Select Users > Lookup > click on ID > go to attributes tab > Add attribute > e.g.: phone > Save

• Select Clients > click on Client ID > go to Mappers Tab > create mapper

  

  

  

• Get custom attributes

  

  

UPDATE

• Add 'phone' attribute on Group level, assign user to that group, and you get 'phone' attribute from group level for all users

• Go back to mapper and update 'phone' with 'Aggregate attribute values = true' and 'Multivalued=true', and you get 'phone' as list with both attributes from group and user level. If you keep 'Aggregate attribute values = false' or 'Multivalued=false', you get just one value, where 'phone' attribute from user will override 'phone' attribute from group (which make sense)

Comments

[Vítor]

stackoverflow.com/questions/29014894/…

[Surya Movva]

I can able to retrieve email id,GivenName,Family Name.But unable to retrieve custom attribute mobile .I'm getting OtherClaims with size 0.

[Surya Movva]

My code is: KeycloakAuthenticationToken token = (KeycloakAuthenticationToken) request. getUserPrincipal(); KeycloakPrincipal principal = (KeycloakPrincipal) token.getPrincipal(); IDToken idToken = principal.getKeycloakSecurityContext().getIdToken(); System.err.println("size "+otherClaims.size()+idToken.getEmail()+idToken.getFamilyNam‌​e());

[Turbut Alin]

@SuryaMovva, have you added the mappings in keycloak administration console under the client you are using?

[troger19]

@TurbutAlin Hi. I have the same problem. I cant see new attributes added to the user. I have added the mapping under my client (spring boot app) and still no new attributes are received. Could you please help? Thanks

[troger19]

Thanks @Neeraj I was doing the same things you just posted. The problem on my side was the cache. After the mapping or user attribute is added, I need to clean the realm cache in Keycloak admin console. Afterwards I was able to see the attributes in otherClaims too. Hope this helps eerybody.

[Neikius]

@troger19 Thank you for this comment, I spent hours upon hours because I didn't think of that.

[user1026498]

Thank you for the solution. Is there a way to apply the custom attributes to all users? I specifically need to do this for all of my users that are imported through my Ldap provider.

[lkamal]

Link is outdated, correct one is keycloak.org/docs/latest/server_admin/…

[Dmitri Algazin]

Thanks for solution! Did what we wanted! Updated your answer with group attributes options

[sunitkatkar]

I'm new to KeyCloak and am using latest ver 6.0.1. Your answer was such a God send - clear, concise and correct! Thanks. Kudos!!

[Panup Pong]

@Neeraj For mobile app I want to keep device_id , device_model , latitude and longtitude when I login via RESTAPI (/openid-connect/token). Keycloak support it?

[denov]

idToken is alway null for me. i do get an access token. i can't figure out what i don't have right. suggestions?