Custom Claims

[jamshally]

I am following the documentation for configuring SSO with a Generic SAML Provider. I have a requirement to receive a custom claim (OrgId), that can somehow be accessible on the authenticated user. It this possible with the BoxyHQ NextAuth integration?

There is a note in the claims mapping docs saying Please refer to the documentation on Identity Provider, but I can't seem to find the relevant info.

Thanks in advance for any advice or pointers.

[niwsa]

@jamshally We do return all the claims that the SAML Provider returns under raw attribute. See https://boxyhq.com/docs/jackson/sso-flow#33-profile-request

[jamshally]

Hi @niwsa. Thank you so much for that quick response, that is very helpful. It seems the raw attribute will provide access to the custom claims when received.

So, how is this handled from the point of view of Service Provider Metadata? With the SAML flows, if I understand correctly, the SP Metadata should reflect all of the expected Claims. So, in this circumstance, we would want to indicate to the IDP (via Metadata), that an OrgId Claim is expected. Am I understanding this correctly, and is there a way to achieve this?

[deepakprabhakara]

@jamshally The custom attributes can be mapped anytime, the SAML metadata file doesn't need to reflect it. What we do is extract all attributes that come through and group them under the raw attribute when you get the userinfo from us. We standardise id, email, firstName, lastName, groups and roles attributes, rest are sent under raw for your application use as necessary.

[PoonamGaudani]

@deepakprabhakara I'm trying to get the value of the upn claim in the user profile using OIDC, but I'm not receiving it. I've checked the optional claims configuration, but it seems like the upn is still missing. Could you help me troubleshoot this issue?

[niwsa]

@PoonamGaudani Where does Jackson come in the picture here ? As far as I understand in this setup Entra ID is your OIDC IdP which is then configured in ADP.

[PoonamGaudani]

@niwsa I followed the steps for ADP (OIDC) app creation to configure Entra ID as the OIDC IdP, and I've already completed the Jackson setup for managing SSO integration.

[niwsa]

@PoonamGaudani Not sure if I am following you correctly. The adp-oidc-tutorial link is for enabling EntraID SSO into ADP portal.
If you are trying to SSO into your own Node.js app (using EntraID) then SSO integration with Jackson makes sense. Anyways happy to jump on a call and understand the setup.

[PoonamGaudani]

@niwsa Just to clarify, I'm not following the Configure ADP (OIDC) SSO steps. Let's connect on a call to discuss further.

[niwsa]

@PoonamGaudani Sure. You can reach me at aswin@boxyhq.com.