Configure multiple subjectMapping in authentication.json

Setup
, ,
1

Can we have multiple subjectmapping in authentication.json file. Error is thrown for below configuration of the authentication.json file.

"subjectMapping" : [
            {
                "resourceTypeMapping" : {
                    "usr" : "managed/user"
                },
                "propertyMapping" : {
                    "sub" : "_id"
                },
                "userRoles" : "authzRoles/*",
                "additionalUserFields" : [
                    "adminOfOrg",
                    "ownerOfOrg"
                ],
                "defaultRoles" : [
                    "internal/role/openidm-authorized"
                ]
            },
			{
                "resourceTypeMapping" : {
                    "usr" : "managed/user"
                },
                "propertyMapping" : {
                    "sub" : "userName"
                },
                "userRoles" : "authzRoles/*",
                "additionalUserFields" : [
                    "adminOfOrg",
                    "ownerOfOrg"
                ],
                "defaultRoles" : [
                    "internal/role/openidm-authorized"
                ]
            }
        ]

Error Reported: rsfilter contains ambiguous subjectmappings

2

@KaranNayyar1 I can’t find any specific documentation that explicitly states that you must use unique resourceTypeMapping values, but looking at this configuration how would you expect IDM to know which property to map to the sub claim?

What is the overall problem you are trying to solve?

3

Are these multiple ‘subjectmapping’ corresponding to multiple realms in AM? If yes, you need to add the ‘realm’ property in each of the ‘subjectmapping’.

For details, check the relevant IDM doc: Authenticate through AM :: IDM 7.5.0

4

The access token when introspected has a sub format in (usr!userName) format. I am expecting IDM to iterate through the array of subjectMapping and map it to the apprpriate mapping found. In this case,below

"propertyMapping" : {
                    "sub" : "userName"
                },
5

Do you need this mapping for the root realm? As @mtuhin pointed out, you can use the realm property to specify the realm for which this mapping will apply.

From the documentation:

You cannot have more than one mapping for the same realm, and you cannot have more than one mapping that has no realm in the configuration.

1 Like
6

Hi KaranNayyar1,

We’re working to enhance the community experience. If you found the information helpful in addressing your inquiry, please select the Best Answer and click the checkbox below the Reply to mark the issue as Solved.

We highly encourage our members to use this feature, as it helps those seeking assistance and those looking for previously provided solutions.

Thank you very much!

Sheila