---
path: faq/sso/keycloak-fullname-saml.mdx
title: Passing attribute values from Keycloak to Passwork
slug: keycloak-fullname-saml
description: >-
  Configuring the transfer of the user's full name from Active Directory/LDAP to
  Passwork through Keycloak and the fullName SAML attribute.
keywords:
  - Passwork
  - SSO
  - Keycloak
  - SAML
  - LDAP
  - Active Directory
  - fullName
  - displayName
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

:::tip
An example of configuring Passwork with Keycloak so that the user's full name attribute is taken from Active Directory/LDAP and delivered over SAML.
:::

## Checking the user attribute

The LDAP user must have the attribute that holds the full name filled in. This example uses `displayName`: the value of this attribute is passed from LDAP to Keycloak as `fullName`, and then sent to Passwork in the `SAML Response`.

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-1.png'}
  alt="The displayName attribute in the Active Directory user record"
  format='regular'
/>

:::info
You can use not only `displayName` to pass the full name, but any other LDAP user attribute that stores the required value. What matters is that the attribute contains a ready-to-use value for Passwork rather than a single part of the name.
:::

Example of the user's values:

```text
displayName = Jane Jackson
givenName   = Jane
sn          = Jackson
mail        = ldap_mid_21@passwork.local
```

## Creating an LDAP mapper

In Keycloak, open the **LDAP provider** settings:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-2.png'}
  alt="The Mappers section in the LDAP provider settings"
  format='regular'
/>

Create a **Mapper** that passes the selected LDAP attribute into the `fullName` Keycloak user attribute:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-3.png'}
  alt="LDAP mapper settings for the fullName attribute"
  format='regular'
/>

## Adding fullName to the User Profile

Open the **User Profile** section:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-4.png'}
  alt="Adding fullName in the User Profile JSON editor"
  format='regular'
/>

And add the `fullName` attribute to the `attributes` array. Example code block for the **JSON Editor** section:

<Tabs className="tabs-container">
  <TabItem className="tab-item-container" value="JSON" label="JSON">

```JSON
{
  "name": "fullName",
  "displayName": "Full name",
  "validations": {
    "length": {
      "max": 255
    }
  },
  "permissions": {
    "view": [
      "admin",
      "user"
    ],
    "edit": [
      "admin"
    ]
  },
  "multivalued": false,
  "group": "user-metadata"
}
```

  </TabItem>
</Tabs>

:::warning
Without this, Keycloak may show the user attribute as an **unmanaged attribute** or hide it in the interface.
:::

## Synchronizing users

After configuring the LDAP mapper, synchronize the users:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-5.png'}
  alt="Starting the LDAP provider user synchronization"
  format='regular'
/>

To verify, open an imported user. The `Full name` value should be shown in the **User metadata** section:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-6.png'}
  alt="The Full name value in the Keycloak user record"
  format='regular'
/>

## Editing the SAML mapper for Passwork

Open the **Client scope** assigned to the Passwork application:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-7.png'}
  alt="The Mappers section in the Passwork client scope"
  format='regular'
/>

Select **Add mapper** → **By configuration** → **User Attribute**:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-8.png'}
  alt="Selecting the User Attribute mapper type"
  format='regular'
/>

Fill in the parameters:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-9.png'}
  alt="SAML mapper settings for the fullName attribute"
  format='regular'
/>

## Configuring the attribute in Passwork

In the Passwork web interface, open **Settings and users** → **SSO settings**. In the **User attributes** section, set the **Full name attribute** parameter to `fullName`:

<ImageComponent
  src={'/img/assets/faq-sso-keycloak-fullname-saml-10.png'}
  alt="Filling in the attribute in Passwork"
  format='regular'
/>

## Checking the SAML Response

Once configured, log in to Passwork through SSO and inspect the `SAML Response` using SAML-Tracer or a similar tool.

A correct SAML attribute must contain `FriendlyName`, `Name`, and `NameFormat`:

```xml
<saml:Attribute FriendlyName="fullName" Name="fullName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
  <saml:AttributeValue>Jane Jackson</saml:AttributeValue>
</saml:Attribute>
```

An incorrect variant:

```xml
<saml:Attribute FriendlyName="fullName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
  <saml:AttributeValue>Jane Jackson</saml:AttributeValue>
</saml:Attribute>
```

The second example is missing `Name="fullName"`. Because of this, Passwork rejects the `SAML Response` as not conforming to the SAML schema.