# Custom attribute from directory to token
**URL:** https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314
**Category:** Securing applications
**Created:** [August 18, 2025, 9:25am UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314 "2025-08-18T09:25:17Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Joachim](https://forum.keycloak.org/u/Joachim)
#### Post date: [August 18, 2025, 9:25am UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/1 "2025-08-18T09:25:17Z")
I want to implement an application that allows to order a service based on the room an employ is working at. Fortunately, my directory provides an attribute roomNumber that I can leverage. But it is not clear to me, how to configure Keycloak accordingly to import, display, and map the attribute to the token.
I started with defining a mapper to import roomNumber, but unfortunately the attribute is not shown in Keycloak when displaying a user, and I also cannot search using that attribute. Is it possible to display additional attributes?
And then, how does one add additional attributes to a token?
---
### Author:  [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)
#### Post date: [August 19, 2025, 11:34am UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/2 "2025-08-19T11:34:49Z")
You need to give more information, as there are so many ways to achieve that in keycloak.
So the kc version, configured options, type of federation etc are needed.
For ldap/ad a user-attribute-ldap-mapper would be the right choice here. And this should also show up in the user ( tab ‘Attributes’)
---
### Author:  [@Joachim](https://forum.keycloak.org/u/Joachim)
#### Post date: [August 19, 2025, 7:41pm UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/3 "2025-08-19T19:41:04Z")
26.3.2
Configured options like this?
Enabled features
ACCOUNT\_API
Supported
ACCOUNT\_V3
Supported
ADMIN\_API
Supported
ADMIN\_FINE\_GRAINED\_AUTHZ\_V2
Supported
ADMIN\_V2
Supported
AUTHORIZATION
Supported
CIBA
Supported
CLIENT\_POLICIES
Supported
DEVICE\_FLOW
Supported
HOSTNAME\_V2
Supported
IMPERSONATION
Supported
KERBEROS
Supported
LOGIN\_V2
Supported
OPENTELEMETRY
Supported
ORGANIZATION
Supported
PAR
Supported
PERSISTENT\_USER\_SESSIONS
Supported
RECOVERY\_CODES
Supported
ROLLING\_UPDATES\_V1
Supported
STEP\_UP\_AUTHENTICATION
Supported
TOKEN\_EXCHANGE\_STANDARD\_V2
Supported
USER\_EVENT\_METRICS
Supported
WEB\_AUTHN
Supported
Disabled features
ADMIN\_FINE\_GRAINED\_AUTHZ
Preview
CLIENT\_SECRET\_ROTATION
Preview
CLIENT\_TYPES
Experimental
CLUSTERLESS
Experimental
DECLARATIVE\_UI
Experimental
DOCKER
Supported
DPOP
Preview
DYNAMIC\_SCOPES
Experimental
FIPS
Supported
INSTAGRAM\_BROKER
Deprecated
IPA\_TUURA\_FEDERATION
Experimental
LOGIN\_V1
Deprecated
LOGOUT\_ALL\_SESSIONS\_V1
Deprecated
MULTI\_SITE
Supported
OID4VC\_VCI
Experimental
PASSKEYS
Preview
QUICK\_THEME
Experimental
ROLLING\_UPDATES\_V2
Preview
SCRIPTS
Preview
TOKEN\_EXCHANGE
Preview
TOKEN\_EXCHANGE\_EXTERNAL\_INTERNAL\_V2
Experimental
TRANSIENT\_USERS
Experimental
UPDATE\_EMAIL
Preview
Federation: I am using LDAP with active directory and kerberos authentication.
What else?
I defined a user-attribute-ldap-mapper for the attribute, but I cannot see the attribute when looking at a user for which I know the attribute exists.
---
### Author:  [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)
#### Post date: [August 20, 2025, 7:02am UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/4 "2025-08-20T07:02:05Z")
did you also reimport the user(s)? Everything isfrom ldap/ad is only updated on synsc, not on login etc.
---
### Author:  [@Joachim](https://forum.keycloak.org/u/Joachim)
#### Post date: [August 20, 2025, 8:16am UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/5 "2025-08-20T08:16:31Z")
Thanks for following up!
I was assuming „Always Read Value From LDAP“ doesn´t require syncing. After syncing the attribute shows up on user General below names, not on tab Attributes as you indicated.
After mapping this attribute with a token mapper I get something like the following in my authorization cookie:
“myvalue”: [“X”, “Y”],
“email”: “[joachim@example.com](mailto:joachim@example.com)”,
…
i.e. the attribute is on same level then identity attributes. I was expecting this under some other path like „resource\_access“ (I ticked both „Add to access token“ and „Add to lightweight access token“ but not „Add to userinfo“).
---
### Author:  [@dasniko](https://forum.keycloak.org/u/dasniko)
#### Post date: [August 24, 2025, 4:04pm UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/6 "2025-08-24T16:04:02Z")
You can probably not see the user attribute, as you have to create proper attribute in the user profile (Realm settings → User profile tab).
Just because you map an attribute from LDAP to Keycloak, it’s not automatically a managed attribute.
Mapping the attribute from the user attributes to the tokens isn’t affected from the user profile attributes, this should work either way. But being able to see the attribute at the user is probably a good first step to “debug” your environment, or being able to find out more about your issue.
---
### Author:  [@Joachim](https://forum.keycloak.org/u/Joachim)
#### Post date: [August 24, 2025, 6:40pm UTC](https://forum.keycloak.org/t/custom-attribute-from-directory-to-token/30314/7 "2025-08-24T18:40:30Z")
Actually I created two attributes, one with just mapping, the other within realm settings, and I didn´t experience any difference so far. Can you please elaborate on the difference of a “managed attbribute” and a “mapped attribute”?
As I wrote above, I can see the attribute on the keycload UI but in a different location than Björn wrote and in the token in a different location than I´d expect.