From 10af53bc84cdbb4799547059e36abe05d9499bc7 Mon Sep 17 00:00:00 2001 From: himeshsiriwardana Date: Tue, 3 Sep 2024 14:09:10 +0530 Subject: [PATCH 1/3] reworded the attribute sharing content --- .../user-attributes/enable-attributes-for-oidc-app.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md b/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md index ab968ef2f6..d038202a33 100644 --- a/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md +++ b/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md @@ -139,9 +139,9 @@ _A sample userinfo response is given below:_ } ``` -## Prioritize local account attributes +## Prioritize sharing local attributes -{{ product_name }} offers the capability to share attributes of a local account during federated a{{ product_name }}uthentication, provided that there exists a local account linked with the federated identity. To prioritize the sharing of attributes from linked local accounts, follow the steps given below: +In a scenario where a user with a local account in {{product_name}}, logs in using [federated authentication]({{base_path}}/guides/authentication/federated-login/), you may want to prioritize sharing local user attributes with the application over those provided by the external identity provider. Follow the steps below to set this priority for sharing user attributes. 1. On the {{ product_name }} Console, go to **Applications**. 2. Select your application and go to its **User Attributes** tab. @@ -149,9 +149,9 @@ _A sample userinfo response is given below:_ ![Prioritize local account attributes]({{base_path}}//assets/img/guides/applications/attributes/oidc/prioritize-local-account-attributes.png){: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} -Once enabled, the tokens issued from this application during federated authentication with an [external identity provider]({{base_path}}/guides/authentication/#supported-external-idps) will contain the attributes of the local account which is linked with the entity identified by the subject claim of the token issued by the external identity provider. +4. Click **Update** to save the changes. -If there is no such linked local account, {{ product_name }} will return the user attributes retrieved from the external identity provider. +When enabled, tokens will include attributes from the linked local user account identified by the subject claim provided by the external identity provider. If a local user account does not exist, {{ product_name }}, instead, will return the user attributes obtained from the external identity provider. !!! note When [JIT provisioning]({{base_path}}/guides/authentication/jit-user-provisioning/#how-jit-provisioning-works) is enabled for the external identity provider, {{ product_name }} ensures that the attributes of the associated local account synchronize with the external identity provider upon each federated login. From 98bcc10148622bf1467e811ad1c60c9f7bbe91d7 Mon Sep 17 00:00:00 2001 From: Himesh Siriwardana Date: Tue, 3 Sep 2024 15:27:30 +0530 Subject: [PATCH 2/3] Update en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md --- .../user-attributes/enable-attributes-for-oidc-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md b/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md index d038202a33..76142dad1d 100644 --- a/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md +++ b/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md @@ -151,7 +151,7 @@ In a scenario where a user with a local account in {{product_name}}, logs in usi 4. Click **Update** to save the changes. -When enabled, tokens will include attributes from the linked local user account identified by the subject claim provided by the external identity provider. If a local user account does not exist, {{ product_name }}, instead, will return the user attributes obtained from the external identity provider. +When enabled, tokens will include attributes from the linked local user account identified by the subject claim provided by the external identity provider. If a local user account does not exist, {{ product_name }}, instead, will share the user attributes obtained from the external identity provider. !!! note When [JIT provisioning]({{base_path}}/guides/authentication/jit-user-provisioning/#how-jit-provisioning-works) is enabled for the external identity provider, {{ product_name }} ensures that the attributes of the associated local account synchronize with the external identity provider upon each federated login. From 9238f191b3b49bce4304f89ee5c28cc5e5dcf219 Mon Sep 17 00:00:00 2001 From: Himesh Siriwardana Date: Tue, 1 Apr 2025 11:59:53 +0530 Subject: [PATCH 3/3] Update en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md --- .../user-attributes/enable-attributes-for-oidc-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md b/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md index 76142dad1d..92dfccb148 100644 --- a/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md +++ b/en/includes/guides/authentication/user-attributes/enable-attributes-for-oidc-app.md @@ -151,7 +151,7 @@ In a scenario where a user with a local account in {{product_name}}, logs in usi 4. Click **Update** to save the changes. -When enabled, tokens will include attributes from the linked local user account identified by the subject claim provided by the external identity provider. If a local user account does not exist, {{ product_name }}, instead, will share the user attributes obtained from the external identity provider. +When enabled, {{product_name}} looks for a linked local user account based on the subject claim provided by the external identity provider. If a local user account is found, the local attributes will be shared with the application. If a local account is not found, user attributes obtained from the external identity provider will be shared with the application. !!! note When [JIT provisioning]({{base_path}}/guides/authentication/jit-user-provisioning/#how-jit-provisioning-works) is enabled for the external identity provider, {{ product_name }} ensures that the attributes of the associated local account synchronize with the external identity provider upon each federated login.