JWT Claims Mapping — Mapping External Identity Claims to JWT Tokens

In this tutorial, you will learn about JWT Claims Mapping. We cover key concepts, practical examples, and best practices to help you master this topic.

JWT claims mapping transforms identity attributes from external sources — LDAP groups, SAML assertions, OIDC claims — into standardized JWT claims for consistent authorization across heterogeneous identity systems.

What You'll Learn

• Claim mapping from external IdPs
• LDAP to JWT group mapping
• SAML assertion to JWT conversion
• Claim enrichment and augmentation
• Normalization for consistent authorization

flowchart LR
    A["External Identity Source"] --> B["LDAP / Active Directory"]
    A --> C["SAML Identity Provider"]
    A --> D["OIDC Provider"]
    A --> E["Custom User Store"]

    B --> F["Claim Mapper"]
    C --> F
    D --> F
    E --> F

    F --> G["Normalized JWT Claims"]
    G --> H["sub: user ID (standardized)"]
    G --> I["roles: [admin, analyst]"]
    G --> J["groups: [security-team]"]
    G --> K["tenant_id: tenant_a"]
    G --> L["permissions: [read:threats]"]

What's Next

Apply claim mapping in your {{< ilink "JWT" "JWT Authentication Service" }} and review {{< ilink "JWT" "JWT Claims" }} for claim Design Patterns.