SAML User with IdP-Initiated is Not Sending the Email in the ID Token
Last Updated:
Overview
SAML user profile contains email, but when the user tries to log in with the IdP-initiated flow, the generated ID token does not contain email.
Applies To
- SAML
- ID Token
Solution
The Query String in the IdP-initiated flow (Dashboard > Authentication > Enterprise > SAML > select the specific SAML connection (tinuiti in this case) > IdP-initiated SSO tab > IdP-initiated SSO Behavior > Query String)
should include any protocol-specific values, such as scope, response_type, redirect_uri, and audience. These values should match the ones expected by the application when using an SP-initiated flow.
The email attribute should be present in the token if email is included in the requested scope.
For example:
scope=openid email profile