# User Attribute Mapping: Getting the roles from the idTokenClaims

**URL:** <https://forum.inductiveautomation.com/t/user-attribute-mapping-getting-the-roles-from-the-idtokenclaims/67093>\
**Category:** Ignition\
**Tags:** ignition81, security\
**Created:** [November 30, 2022, 4:29pm UTC](https://forum.inductiveautomation.com/t/user-attribute-mapping-getting-the-roles-from-the-idtokenclaims/67093 "2022-11-30T16:29:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicky\_Goethals](https://avatars.discourse-cdn.com/v4/letter/n/8e8cbc/32.png) [@Nicky\_Goethals](https://forum.inductiveautomation.com/u/Nicky_Goethals)\
**Post date:** [November 30, 2022, 4:29pm UTC](https://forum.inductiveautomation.com/t/user-attribute-mapping-getting-the-roles-from-the-idtokenclaims/67093/1 "2022-11-30T16:29:46Z")

</div>

I am having issues getting either an array or values from an idToken to be mapped when logging in using an Identity Provider.

The configuration is done in: Config / Security / Identity Providers / example\_identity\_provider - User Attribute Mapping

Taking the following example, what would the path look like to get the mapping to the user, admin roles ( JSONPath: $.idTokenClaims.[example-of-roles][\*] ).

```auto
{
  "idTokenClaims": {
  "userInfo": {
    "https://exaple.io/jwt/claims": {
      "example-of-roles": [
        "user",
        "admin"
      ]
    }
  }
 }
}

```

I have been trying a lot of things, the roles have also been added identically to the default user provider which is used by the idp.

The documentation does not make me much wiser ([User Attribute Mapping - Ignition User Manual 8.1 - Ignition Documentation](https://docs.inductiveautomation.com/display/DOC81/User+Attribute+Mapping))

Kind Regards

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [December 3, 2022, 1:19am UTC](https://forum.inductiveautomation.com/t/user-attribute-mapping-getting-the-roles-from-the-idtokenclaims/67093/2 "2022-12-03T01:19:08Z")

</div>

I am assuming the json you posted is a snippet from the "Response Data" tab on the Test Login results page in the Gateway Config UI, tested against an external OIDC IdP (correct me if I am wrong).

If that's the case, then using a user attribute mapper of type **direct** , I would think this should work:

Source: `ID Token Claims`  
Path: `userInfo["https://exaple.io/jwt/claims"]["example-of-roles"]`

---

<div class="post-metadata">

**Author:** ![Nicky\_Goethals](https://avatars.discourse-cdn.com/v4/letter/n/8e8cbc/32.png) [@Nicky\_Goethals](https://forum.inductiveautomation.com/u/Nicky_Goethals)\
**Post date:** [December 15, 2022, 9:52am UTC](https://forum.inductiveautomation.com/t/user-attribute-mapping-getting-the-roles-from-the-idtokenclaims/67093/3 "2022-12-15T09:52:42Z")

</div>

Hi,

I had to give the path in this way:

["[https://exaple.io/jwt/claims"]["example-of-roles](https://exaple.io/jwt/claims%22%5D%5B%22example-of-roles)"]

Without userInfo in front of it.

That solved it.

Kind Regards,  
Nicky