In this article, we will show you how to set up custom claim mapping for Single Sign On (SSO). Typically you might want to add custom claims where the username identifier you are using does not directly match the username identifier required for Kallidus to authenticate you.
There are 2 scenarios to consider:
Most customers do not need to create custom claims. This is only necessary if you use a custom identifier (which is quite rare).
Set up custom claims where you manage and edit them yourself
By default, Kallidus will match on preferred username. This section will give instructions on how to edit this if it does not match. You will need to add a custom attribute to the claims with the name "https://www.kallidus.com/username".
This section includes details for:
Microsoft Entra ID
These steps need to be undertaken in Microsoft Entra ID by your IT team. We assume the Kallidus configuration is already set, and you are creating a custom claim for this:
- Go to 'Enterprise applications' and find the Kallidus configuration, which should already be set up
- Select the 'Single Sign-on' option from the left-hand menu:
- Select 'Edit' in the Attributes and Claims section:
-
Add a new claim. The name of the claim is https://www.kallidus.com/username:
-
Add the Source. Here, you need to add the value you wish to use. It needs to match the username field in the Kallidus suite:
- Select 'App registrations', locate the Kallidus configuration in the list and highlight it
- Select the Manifest option from the menu in the left panel
- Change 'AcceptmappedClaims' to True:
Please note: We do not support the use of custom signing keys. You will need to set the acceptMappedClaims property to true in the application manifest. As documented on the apiApplication resource type. Setting the property allows an application to use claims mapping without specifying a custom signing key.
Google Workspace
- Go to 'Apps'
- Go to 'Web and mobile apps:
- Select and open the app you have created to link with Kallidus:
- Select to expand the SAML attribute mapping section
- Select to 'Add Mapping':
- Select the directory field which maps to your username in the Kallidus platform
- Under App attributes, add https://www.kallidus.com/username
- Save your changes
Set up custom claims where they are fixed and cannot be changed
When setting up a new SSO identity provider within the settings area of the Manage Users area, you can setup claim mappings. Typically this is used where the username used in the Kallidus platform to identify a user is not a standard username claim/attribute used by the SSO identity provider (e.g. preferred_username in an Entra ID OpenID Connect identity provider). It helps overcome differences between user data that you send from your identity provider and those used when setting up users in Kallidus.
To do this, either edit an existing SSO setup or create a new one within the Settings > SSO providers section. Claim mappings can be added in the Claim mappings section.
If you need assistance on this please do raise a ticket.
Ask the Community🤝
Want to connect with peers and hear how they work with Kallidus? Our customer Community is a great place to get quick, relatable advice - so jump in, ask your question, and learn from the wider customer Community.
Get deeper learning in The Academy🎓
The Academy provides structured learning paths you can follow at your own pace, along with live events where you can connect with the Kallidus team and fellow learners. If you're new to Learn LMS Get started: Learn is the place to start.
Don't have your account yet? Contact the Customer Support Team to activate your free account.