[IDE Services On Premise] How to configure custom subject field in user properties

Question

How can the subject field in user properties within IDE Services be configured to use a custom claim from the IdP instead of the default sub claim?

Answer

By default, the users subject parameter in IDE Services (IDES) is derived from the IdP sub claim. For instance, in Okta, this claim could correspond to a UID with outputs such as:

{
  "sub": "00bacheorqFNEszcE228",
  "name": "Test User",
  "email": "testuser@example.com",
  "iss": "https://<okta_domain>/oauth2/default",
  "aud": "0abobaj1qziZitKcx4698",
  "iat": 1765300650,
  "exp": 1765304250,
  "jti": "ID.Z2JZvh***nxNr2BQK8Q",
   ...
  "auth_time": 1000,
  "at_hash": "preview_at_hash"
}

This results in the users subject being displayed as 00bacheorqFNEszcE228 in the system. To configure the subject field to use a custom claim (e.g., email), the following steps should be followed:

1. Modify the tbe.auth mode to opaque token introspection by updating the configuration file:

     auth:
       login-url: "https://<okta_domain>/oauth2/default/v1/authorize"
       token-url: "https://<okta_domain>/oauth2/default/v1/token"
       token-introspection-url: "https://<okta_domain>/oauth2/default/v1/introspect" # use it instead of jwt-certs-url parameter
       user-id-path: "email" # map the subject parameter to the custom claim propagated by IdP
       client-id: "********697"
       client-secret: "P*****3"
       required-scopes: [ "profile", "email", "openid", "offline_access"]
       root-admin-emails:
         - "testuser@example.com"
   

2. Adjust the custom claim in your IdP configuration if necessary (e.g., set it to email as used in the mapping above).

3. Restart IDE Services to apply the changes.

4. After logging in, the subject parameter will now utilize the custom claim. For instance, if mapped to email, it will show the email address as the subject.