# Pass authNote from authenticator to protocol mapper

**URL:** <https://forum.keycloak.org/t/pass-authnote-from-authenticator-to-protocol-mapper/25053>\
**Category:** Extending the server\
**Tags:** authentication\
**Created:** [March 14, 2024, 8:59am UTC](https://forum.keycloak.org/t/pass-authnote-from-authenticator-to-protocol-mapper/25053 "2024-03-14T08:59:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kermit](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kermit/32/9170_2.png) [@Kermit](https://forum.keycloak.org/u/Kermit)\
**Post date:** [March 14, 2024, 8:59am UTC](https://forum.keycloak.org/t/pass-authnote-from-authenticator-to-protocol-mapper/25053/1 "2024-03-14T08:59:57Z")

</div>

Hi, I have a custom authenticator that extends UsernamePasswordForm to retrieve the value of a third input on the login page.

```auto
@Override
    protected boolean validateForm(AuthenticationFlowContext context, MultivaluedMap<String, String> formData) {
        try {
            final String codeClient = formData.getFirst(CODE_CLIENT_INPUT);
// keycloakSession.getContext().getAuthenticationSession().setAuthNote(CODE_CLIENT_INPUT, codeClient);
            context.getAuthenticationSession().setAuthNote(CODE_CLIENT_INPUT, codeClient);
            return super.validateForm(context, formData);
        } catch (Exception e) {
            context.failure(AuthenticationFlowError.INTERNAL_ERROR);
            return false;
        }
    }

```

now, I need to retrieve this value from my custom protocol mapper which extends AbstractOIDCProtocolMapper and implements OIDCAccessTokenMapper but in the current code, with all the ways I’ve tried, I can’t get it, it’s null. What have I done wrong? Thanks for clarifying

```auto
    @Override
    protected void setClaim(IDToken token, ProtocolMapperModel mappingModel,
                            UserSessionModel userSession, KeycloakSession keycloakSession,
                            ClientSessionContext clientSessionContext) {
        MultivaluedMap<String, String> formData = keycloakSession.getContext().getHttpRequest().getDecodedFormParameters();
        String codeClient = "";

// log.info("setClaim, session={}", keycloakSession.getContext().getAuthenticationSession().getAuthNote("cc"));
        log.info("setClaim, session={}", clientSessionContext.getClientSession().getNote("cc"));

        if (formData.containsKey("cc")) {
            codeClient = formData.getFirst("cc");
            token.setPreferredUsername("ADMIN@" + codeClient);
        }

        List<Activity> activities = fetchActivitiesFromDatabase(userSession.getLoginUsername(), mappingModel, codeClient);

        try {
            OIDCAttributeMapperHelper.mapClaim(token, mappingModel, objectMapper.writeValueAsString(activities));
        } catch (JsonProcessingException e) {
            log.error("setClaim, activities={}, exception={}", activities, e);
            throw new RuntimeException(e);
        }
    }

```

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [March 14, 2024, 5:15pm UTC](https://forum.keycloak.org/t/pass-authnote-from-authenticator-to-protocol-mapper/25053/2 "2024-03-14T17:15:52Z")

</div>

If you’re trying to get something from the authentication to a token, I’d suggest storing it in a User Session Note. There is already a mapper in Keycloak for taking things from User Session Notes and putting them in the token.

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/e/ed0b78463fa0831ebc23ceffbd91a78078c1a8e0.png)

Auth Notes are for the authentication flow and will not be present after the flow has completed. Also, you’re getting a Client Session Note in your mapper, which is different from either Auth Notes or User Session Notes.