How to map user information during enrollment via oauth source

[tograss]

I'm trying to connect Authentik and Microsoft Entra ( former Azure AD) . I can setup the connection and login with my test user but how
do I map the properties from the entra user to the corresponding authentik user?
Any hints or a link to the relevant documentation would be really appreciated.

Maybe this can also be phrased as a more general question how to I map information from federated idp providers. For LDAP there are property mappings but the same does not exist for saml / oauth sources.

[BeryJu]

Currently this has to be done in the enrollment/authentication flow through policies, before the user_write stage, you can access oauth_userinfo in the policy context to access the data from the userinfo endpoint.

(It's been on our roadmap for quite a long time to add property mappings for saml/oauth sources)

[tograss]

Thank you very much ! I got a working solution . Tomorrow or a least till end of this week I will add a pull request to improve the documentation. It might help others ( or me the next time ) .

[leisefuxX]

Thank you very much ! I got a working solution .

can u provide your mappings, for all us uninitiated users out there :D i have the same problem...

[tograss]

@leisefuxX Have a look at the pull request and let me know if its understandable . 😅

[leisefuxX]

hey @tograss

your solution works as intended and your documentation of the solution is also understandable and easy to follow.

It would be cool if a corresponding azure-enrollment was directly on board and you could simply click it together... maybe that would be something for 2023.10.8 (:

thanks for sharing and posting! you helped me a lot

[ll-innovationRD]

Currently this has to be done in the enrollment/authentication flow through policies, before the user_write stage, you can access oauth_userinfo in the policy context to access the data from the userinfo endpoint.

(It's been on our roadmap for quite a long time to add property mappings for saml/oauth sources)

hi,
I encountered the same issue with MS ENTRA/AzureAD. The request was successful, but the username field returned as AnonymousUser. It was clearly visible in the logs. The guide for Google describes the same problem and provides a solution at https://goauthentik.io/integrations/sources/google/.

The solution involves creating a policy expression and applying it to the flow that generates the user on the first access. I configured a policy like this:

username = request.context["oauth_userinfo"]["unique_name"]
request.user["username"] = username
return False

This way, the username field is populated correctly. You can also populate other fields such as email if they coincide:
request.user["email"] = username

I hope this can be helpful.