Correct way to customize keycloak access token with scenario where we're using azure ad as authentication provider[Keycloak]

Question

We are using azure ad as an idp for authentication, We want to add additional attributes like roles etc. to the access token. These additional attributes are coming from existing application.

What is the correct way to get these attributes from existing system and add to the access token?

Answer 1

You can build your own custom claim mapper as presented in here. Which reads the custom claims from the application and adds them to the token.

Alternatively, you can also use script mappers. Finally, you can also have a look at UMA flow and use the feature of pushing claims.