External Id claims contact mapping

(2) Share

Report

Posted on by thordurg

Hello!

Is it possible to map an existing contact to a custom claim, from an external identity provider authentication, and not the standard sub claim? I have a unique identifier in the claim I need to map to an existing pre-configured contact.

Thanks.

Categories:

Security

I have the same question (0)

All responses (5)

Answers (0)

Suggested answer

oliver.rodrigues 9,368 Most Valuable Professional on at

Like (0)

Report

You can map any returned Claim within the Token to a field in the Contact record. - https://learn.microsoft.com/en-us/power-pages/security/authentication/openid-provider

However not sure if you mean mapping the main unique id that will be used to authenticate the user, I don't think we can do that. Can you give more details?

Was this reply helpful? Yes No
thordurg 9 on at

Like (0)

Report

I'm essentially looking to associate a unique contact record with a matching unique claim value and automatically assigning the contact after the user successfully signs in. This seems to be supported oob for emails.

My scenario is that I have an external provider that returns an id_token that includes a claim called nin, national identification number that I would like to map to a pre configured contact, somehow, and without sending an invitation, if possible.

Was this reply helpful? Yes No
Suggested answer

Fubar 8,350 Super User 2025 Season 2 on at

Like (0)

Report

If what you are saying is that you have an existing Contact with the nin and when someone registers from the External Identity Provider you want to map that External Identity to that Contact based on the nin - then out of the box the answer would be No (only mapping available is is email address mapping - or via invitations).

Was this reply helpful? Yes No
Suggested answer

oliver.rodrigues 9,368 Most Valuable Professional on at

Like (0)

Report

If possible, I think you should look into a custom invitation business process, so you can create an Invitation record for the correct ID based on your Identity Provider specific claim.

Another approach, but not sure if it's really possible would be to use pre-validation/pre-operation Plug-ins in Dataverse and basically interject the creation of the contact record when they are signing-up, and instead of creating, passing to the context the existing Contact based on your business logic.

No idea if that would work, and it would be considered something very custom.

Was this reply helpful? Yes No
thordurg 9 on at

Like (0)

Report

Thank you for all your suggestions.

This is certainly not possible, as suggested, to achieve directly with the Power Pages connector. The solution was to use Azure B2C and set up the external provider there. That allowed us to create the power pages contact user and Azure user beforehand, and then map the the authentication claim to the user.

Was this reply helpful? Yes No