goauthentik / goauthentik/authentik
Entra ID / OAuth Source Property Mapping - Add a checkbox/toggle to automatically default to UPN if Email is blank for Federation & Social Sources
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Is your feature request related to a problem?
I am using Entra ID to authenticate to various OIDC apps. I invited a user who was only an admin, with no mailbox license in entra ID to my apps. The email field was blank and it caused a whole bunch of issues with signing in that were hard to debug before realizing what happened.
### Describe the solution you'd like
I'd like authentik to have a checkbox or toggle somewhere that could essentially enable the following OAuth source property mapping automatically for that source or specifically entra ID source.
```
return {
"email": info.get("mail") or info.get("userPrincipalName"),
}
```
### Describe alternatives that you've considered
It is simple enough to just setup the Oauth source property mapping yourself, but arriving to the decision could be hard for slightly less technical users.
Another alternative would be mentioning this as an example in the documentation explaining that various apps will only work if you have an "email" field populated for your users, and to always populate the email field you can do the following steps.
1. Create a custom OAuth source property mapping within customizations -> property mapping
2. Include an expression of the following:
```
return {
"email": info.get("mail") or info.get("userPrincipalName"),
}
```
3. Assign the property mapping to your federation & social login source
### Additional context
Obviously, this is quite an edge case, and may not be aligned with the principles of the project, but I just wanted to submit the idea in case I could help someone out in the future with the same issue.
Cheers!
Contributor guide
Assessment
This issue has not been assessed yet.