From 7d34100a44f7c1d1fc3f3c28d4e1dfb00c5f4900 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Tue, 18 Aug 2026 16:11:41 +0530 Subject: [PATCH 1/4] Add Entra configurations --- .../modules/oidc.md | 31 ++++++++++++++++--- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 8e836355bbf..ad68a925571 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -411,6 +411,23 @@ For Entra ID access to APIs through an access token, in addition to the configur Now, you can acquire tokens which can be validated using JWKS URI. +#### Configuring Optional Claims for User Attributes {#entra-optional-claims} + +By default, Microsoft Entra ID does not include user attribute claims such as `given_name` (first name) and `family_name` (last name) in the ID token, even when the `profile` scope is requested. These claims are required if you want to map a user's display name during provisioning. To make these claims available, add them as optional claims in the Entra App Registration: + +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). +2. Go to **Entra ID** > **App registrations** and select your application. +3. In the left menu, select **Token configuration** and click **Add optional claim**. +4. Select **ID** as the **Token type**. +5. Select the claims you need, for example, `given_name` and `family_name`. +6. Click **Add**. + +After completing these steps, the claims will be included in the ID token and will be available for attribute mapping in the Mendix OIDC SSO configuration. + +{{% alert color="info" %}} +If `given_name` or `family_name` are present in your ID token after adding them as optional claims but do not appear in the ****Add Claim** dropdown in the Mendix OIDC configuration, see [Creating IdP Attribute Manually](/appstore/modules/oidc/#creating-idp-attribute-manually) for steps to add these claims manually. +{{% /alert %}} + #### Amazon Cognito Client Configuration For more information about configuring your app for OIDC with Amazon Cognito, see [Amazon Cognito: Configuring the Required Settings in Your Mendix App](/appstore/modules/aws/amazon-cognito/#cognito). @@ -682,6 +699,12 @@ IdP attributes will be automatically created from the list of `claims_supported` Select the required attribute to use it in your mapping. +{{% alert color="info" %}} +If you are using Microsoft Entra ID and the expected claims (such as `given_name` or `family_name`) do not appear in the **Add Claim** dropdown, this is because Entra does not advertise these claims in its discovery endpoint. You have two options: + +* Add the claims as optional claims in the Entra App Registration's **Token configuration** tab. See Microsoft [Configuring Optional Claims for User Attributes](#entra-optional-claims) for steps. +* Configure a Custom User Parsing Microflow in your ClientConfiguration. Use the `OIDC.CreateClaimsWithJSON` action to extract and map claims directly from the `OpenIDTokenJSON` parameter to your user entity attributes. For more information, see [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). {{% /alert %}} + ##### User Provisioning Using Your Custom User Entity{#custom_user_entity} If you want to use your custom user entity, which is a specialization of the `System.User` entity to store user information, select it in the **Custom user Entity (extension of System.User)** field by replacing the `Administration.Account` entity. @@ -715,10 +738,10 @@ The section below shows the methods to configure user provisioning when using OI By default, the `CUSTOM_UserProvisioning` microflow in the **USE_ME** > **1. Configuration** folder of the OIDC module uses the `OIDC_CustomUserParsing_Standard` microflow. This applies to the following mapping: | ID-token Provided by your IdP | Attribute of `Administration.Account` Object | -| ----------------------------- | ----------------------------- | -| sub | Name | -| name | Fullname | -| email | Email | +| ----------------------------- | ----------------------------- | +| sub | Name | +| name | Fullname | +| email | Email | {{% alert color="warning" %}} Do not change the `UserProvisioning_StandardOIDC` microflow. This may cause problems if you upgrade to a newer version of the OIDC SSO module. Apply customizations to the `CUSTOM_UserProvisioning` microflow only. From b50f7421c6e4a77002e200c291072d0c74b0e371 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Fri, 21 Aug 2026 16:01:06 +0530 Subject: [PATCH 2/4] Add more changes --- .../platform-supported-content/modules/oidc.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index ad68a925571..c49be8ffb9f 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -700,10 +700,16 @@ IdP attributes will be automatically created from the list of `claims_supported` Select the required attribute to use it in your mapping. {{% alert color="info" %}} -If you are using Microsoft Entra ID and the expected claims (such as `given_name` or `family_name`) do not appear in the **Add Claim** dropdown, this is because Entra does not advertise these claims in its discovery endpoint. You have two options: +If you are using Microsoft Entra ID and the expected claims (such as `given_name` or `family_name`) do not appear in the **Add Claim** dropdown, this is because Entra does not advertise these claims in its discovery endpoint. To make them available, add them as optional claims in the Entra App Registration's **Token configuration** tab. For more information, see the [Configuring Optional Claims for User Attributes](#entra-optional-claims) section. -* Add the claims as optional claims in the Entra App Registration's **Token configuration** tab. See Microsoft [Configuring Optional Claims for User Attributes](#entra-optional-claims) for steps. -* Configure a Custom User Parsing Microflow in your ClientConfiguration. Use the `OIDC.CreateClaimsWithJSON` action to extract and map claims directly from the `OpenIDTokenJSON` parameter to your user entity attributes. For more information, see [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime). {{% /alert %}} +After adding the optional claims to the Entra App Registration, use one of the following options to get the claims in the **Add Claim** dropdown: + +* Search for the claims: In the **Add Claim** dialog, click **Search** and then click **New**. Provide **Claim Name** and **Friendly Name** (optional claims configured in the Entra App Registration). Click **Previous**, find the newly added claims and add them. +* Add claims to the default setup: Add the claims to the `SUB_DefaultUserProvisioning` microflow, then map them: + 1. In the `SUB_DefaultUserProvisioning` microflow, add a `CreateClaim` activity for `family_name`, `given_name`, or any custom attribute configured in the Entra App Registration to populate in the token. To reuse an existing activity, copy a `CreateClaim` activity from the same microflow and update the claim name value. + 2. Click **Add Claim** and select `family_name` or `given_name` from the **IdP Attribute** dropdown. + 3. Map to the **Custom Entity Attribute** and click **Save**. +{{% /alert %}} ##### User Provisioning Using Your Custom User Entity{#custom_user_entity} From 0e9d54fd10dc170f1d0c7ae45489d899e41e3ec1 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Fri, 21 Aug 2026 16:05:23 +0530 Subject: [PATCH 3/4] Correct UI text --- .../docs/marketplace/platform-supported-content/modules/oidc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index c49be8ffb9f..f9d2389bad2 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -704,7 +704,7 @@ If you are using Microsoft Entra ID and the expected claims (such as `given_name After adding the optional claims to the Entra App Registration, use one of the following options to get the claims in the **Add Claim** dropdown: -* Search for the claims: In the **Add Claim** dialog, click **Search** and then click **New**. Provide **Claim Name** and **Friendly Name** (optional claims configured in the Entra App Registration). Click **Previous**, find the newly added claims and add them. +* Search for the claims: In the **Add Claim Map** dialog, click **Search** and then click **New**. Provide **Claim Name** and **Friendly Name** (optional claims configured in the Entra App Registration). Click **Previous**, find the newly added, optional claims and add them. * Add claims to the default setup: Add the claims to the `SUB_DefaultUserProvisioning` microflow, then map them: 1. In the `SUB_DefaultUserProvisioning` microflow, add a `CreateClaim` activity for `family_name`, `given_name`, or any custom attribute configured in the Entra App Registration to populate in the token. To reuse an existing activity, copy a `CreateClaim` activity from the same microflow and update the claim name value. 2. Click **Add Claim** and select `family_name` or `given_name` from the **IdP Attribute** dropdown. From 0f7d62bbb260f9bfe9ac5d37583cb64b12370c76 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Fri, 21 Aug 2026 16:14:18 +0530 Subject: [PATCH 4/4] Fix error --- .../docs/marketplace/platform-supported-content/modules/oidc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index f9d2389bad2..31a630ffc92 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -425,7 +425,7 @@ By default, Microsoft Entra ID does not include user attribute claims such as `g After completing these steps, the claims will be included in the ID token and will be available for attribute mapping in the Mendix OIDC SSO configuration. {{% alert color="info" %}} -If `given_name` or `family_name` are present in your ID token after adding them as optional claims but do not appear in the ****Add Claim** dropdown in the Mendix OIDC configuration, see [Creating IdP Attribute Manually](/appstore/modules/oidc/#creating-idp-attribute-manually) for steps to add these claims manually. +If `given_name` or `family_name` are present in your ID token after adding them as optional claims but do not appear in the **Add Claim** dropdown in the Mendix OIDC configuration, see [Creating IdP Attribute Manually](/appstore/modules/oidc/#creating-idp-attribute-manually) for steps to add these claims manually. {{% /alert %}} #### Amazon Cognito Client Configuration