How to get Keycloak identity broker to display claims in ID token from Entra ID / Azure identity Provider

Question

I'm trying to retrieve some claims (roles, groups, upn) from an ID token using Keycloak as an identity provider for an OIDC app configured on Entra ID.

Using Postman, I can retrieve the ID token directly from Entra ID and the claims are there. So it's just a question of configuring Keycloak to correctly map the claims.

I've tried following this SO link, but with no luck. I've tried both the mapping described and even adding a upn client scope. Ideally, I'm trying to get the roles.

Can someone provide some insight on how to do this?

Answer 1

Regarding the upn field as written here it's required the scope profile.
Open the advanced settings, in the keycloak section "identity provider" and make sure you've added openid profile in the list of scopes. By default it's empty that means only openid