Service call type: AQ_GetAuthenticationClaims

The AQ_GetAuthenticationClaims service can be used to map one or more authentication claims to specified attributes in the profile. This service works with single or multivalued attributes.

Parameters

To be able to map authentication claims to your profile, two steps are required:

1. Configure your runtime as described in OpenID Connect configuration. Make sure that the right claims are mapped to the technical Blueriq scope (section Mapping claims from the ID token).
2. Model a service call of type AQ_GetAuthenticationClaims and specify in it which claims need to be mapped to which attribute.

Example usage AQ_GetAuthenticationClaims service

First examine the JWT token:

{
...
  "resource_access": {
    "blueriq-runtime": {
      "roles": [
        "aanvrager"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "preferred_username": "aanvrager",
  "custom_username": "The real aanvrager"
  "email": "the_real_aanvrager@blueriq.com"
...
}

Then configure the properties:

blueriq.security.jwt-claims.claim-mapping.username=$.custom_username
blueriq.security.jwt-claims.claim-mapping.roles=$.resource_access.account.roles

Map the claims to the profile using the service:

Exit events