Attribute Configuration between Azure AD for OpenID

Question

Hello Experts,

I need your support with the configuration of attributes between Azure AD and SAP IAS. I have configured the OpenID Connect protocol between Azure and SAP IAS. An app has been configured in SAP IAS, and the user should be able to log in to this app.

However, I don’t understand how the attributes are transferred in this context. I tested by deleting all attributes in SAP IAS, but attributes are still being transmitted to the cloud app. In Azure, under App Registration > Token Configuration, I defined the attributes email, family_name, and given_name, and these are exactly the attributes being transmitted to the app. It doesn’t matter which attributes I have defined in IAS.

Now, my question is: How can I define in Azure that additional attributes, such as Employee Number, Department, etc., should also be transmitted?

When configuring SAML between apps, I can define Claims in Azure.

Is this also possible for OIDC?

I look forward to your response.

Thank you in advance

Best Regards

Answer 1

Hello Mike,

Thanks for posting your question in the Microsoft Q&A forum.

You can follow these steps:

• In Azure AD, navigate to your App Registration for SAP IAS, go to Token configuration and select Add optional claim then choose the token type (ID token or Access token) and add the desired claims and then go to App registrations > Your app > Manifest
• In the manifest, add your custom attributes under the optionalClaims section
• Save the changes to the manifest.
• In SAP IAS, go to the Applications section and select your application
• Navigate to Subject Name Identifier and Assertion Attributes
• Configure the attribute mapping to match the claims sent from Azure AD

Remember that the attributes must exist in Azure AD and be associated with the user accounts. For custom attributes, you may need to configure them in Azure AD first and populate them with data.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful

Answer 2

Hello Mike,

We understand that you have registered an app in Azure (OpenID - OIDC). You are now looking for an option where you can add other user attributes such as Employee ID, department, city, etc.

Please find below steps to pass additional attributes like Employee ID and Department in the access token.

Modify the Manifest:

• Go to App Registration > your application > Manifest (on the left menu).
• Search for acceptMappedClaims and set its value to true in the Manifest file.

Add Claims to the Access Token:

• Go to Enterprise Applications > your application > Single sign-on > Attributes & Claims > Edit.

• Add the required attributes and map them to the appropriate claims that you want to pass on to the access token.

After completing these steps, both claims (Employee ID and Department) will be added to the access token, allowing access to the application with these claims included.

On the second query, your Service Provider SAP IAS is set up to authenticate users based on a specific claim — email address, but not UPN.

SAP IAS may be configured to authenticate based on the email address claim and may not recognize the UPN as a valid identifier.

If your configuration in Azure AD is passing the UPN as the identifier in the token, but SAP IAS is expecting the email address, authentication will fail.

I request you to check authentication settings on SAP IAS if it is configured email address as identifier and configure SAP IAS to accept the UPN directly if that's supported.

And if it is not supported, you can map the UPN to a custom claim in Azure AD and configure SAP IAS to use that custom claim for authentication

Thanks,

Venkata Jagadeep.