# Keycloak uses ADFS as Identity Provider, How to map Attribute from ADFS other than email, lastname, name?

**URL:** <https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240>\
**Category:** Getting advice\
**Created:** [July 31, 2024, 1:14pm UTC](https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240 "2024-07-31T13:14:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chanwitkepha](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/chanwitkepha/32/4543_2.png) [@chanwitkepha](https://forum.keycloak.org/u/chanwitkepha)\
**Post date:** [July 31, 2024, 1:14pm UTC](https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240/1 "2024-07-31T13:14:01Z")

</div>

Hello everyone.

I have Keycloak 16.1.1 connect with ADFS according to documentation in this URL  
[How to Setup MS AD FS 3.0 as Brokered Identity Provider in Keycloak - Keycloak](https://www.keycloak.org/2017/03/how-to-setup-ms-ad-fs-30-as-brokered)

I already add Attribute email, lastname, name, GroupManagers according to document.

Now I try to be mapping some custom Attribute from ADFS (as in picture below) but I would like to know how to mapping custom attribute from ADFS and how to check if Keycloak can mapping it properly. Please advices, Thank you for your kindly help

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/6/65a4b18a25600290a599cd2e1e898caa41e3c55b.png)

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/d/ddd4608c30eb5fcb82c6fe4b1d3bd5c367f4db31.png)

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/5/56736960046389ebbebe846b2b9b561ce554d76b.png)

---

<div class="post-metadata">

**Author:** ![djordje](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/djordje/32/10815_2.png) [@djordje](https://forum.keycloak.org/u/djordje)\
**Post date:** [August 2, 2024, 12:58pm UTC](https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240/2 "2024-08-02T12:58:37Z")

</div>

Hi, if Keycloak does not support it by default with some mapper, then you can create your custom mapper:

```auto
public class SamlAttributeMapper implements IdentityProviderMapper{

... required methods ... 

    static {
        ProviderConfigProperty property;

        property = new ProviderConfigProperty();
        property.setName("attribute.name");
        property.setLabel("Attribute Name");
        property.setHelpText("Name of the SAML attribute to map.");
        property.setType(ProviderConfigProperty.STRING_TYPE);
        configProperties.add(property);

        property = new ProviderConfigProperty();
        property.setName("user.attribute");
        property.setLabel("User Attribute");
        property.setHelpText("Name of the user attribute to map the SAML attribute to.");
        property.setType(ProviderConfigProperty.STRING_TYPE);
        configProperties.add(property);
    }

    @Override
    public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
        String attributeName = mapperModel.getConfig().get("attribute.name");
        String userAttribute = mapperModel.getConfig().get("user.attribute");

        String attributeValue = context.getContextData().get(attributeName).toString();
        context.setUserAttribute(userAttribute, attributeValue);
    }

    @Override
    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
        preprocessFederatedIdentity(session, realm, mapperModel, context);
    }

    @Override
    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
        preprocessFederatedIdentity(session, realm, mapperModel, context);
    }

}

```

Do not forget to add provider Id and to register it in:  
org.keycloak.broker.provider.IdentityProviderMapper META-INF

---

<div class="post-metadata">

**Author:** ![BillySchwartz16](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/billyschwartz16/32/11029_2.png) [@BillySchwartz16](https://forum.keycloak.org/u/BillySchwartz16)\
**Post date:** [August 5, 2024, 4:56am UTC](https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240/3 "2024-08-05T04:56:34Z")

</div>

Couple of troubleshooting tips:

1. If you are using SAML, use the “Saml-tracer “ chrome extension to view the claims being sent. If the claim is not sent, you cannot map it.

2. If the claim is there, make sure the value matches.

3. Try deleting the user in keycloak and logging in fresh.

---

<div class="post-metadata">

**Author:** ![chanwitkepha](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/chanwitkepha/32/4543_2.png) [@chanwitkepha](https://forum.keycloak.org/u/chanwitkepha)\
**Post date:** [August 6, 2024, 8:21am UTC](https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240/4 "2024-08-06T08:21:07Z")

</div>

Thank you, I will try to use SAML-Tracer for check its.

---

<div class="post-metadata">

**Author:** ![chanwitkepha](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/chanwitkepha/32/4543_2.png) [@chanwitkepha](https://forum.keycloak.org/u/chanwitkepha)\
**Post date:** [August 6, 2024, 8:28am UTC](https://forum.keycloak.org/t/keycloak-uses-adfs-as-identity-provider-how-to-map-attribute-from-adfs-other-than-email-lastname-name/27240/5 "2024-08-06T08:28:51Z")

</div>

Thank you for your help. I search additional information from Zerto  
[Zerto Knowledge Portal](https://help.zerto.com/bundle/Linux.ZVM.HTML.10.0_U1/page/IDP_Using_SAML.htm)

and found that I must create Keycloak Client Mapper for receive value from custom IDP Mapper too.