mailnickname not populated in JWT access token

Question

Hi,
I am using OIDC authentication (using Azure AD) for Hashicorp Vault application. I am successful in populating metadata like oid (object ID), upn (user prinicipal name) and name of the user. But I am unable to get mailNickname from JWT token claim.

On decoding the access token for my user, I do not see mailNickname as an attribute in the claims. Although if I hit, https://graph.microsoft.com/beta/me for my user, I see mailNickname as one of the attributes. I have given profile,
Directory.Read.All, GroupMember.Read.All permissions for Microsoft Graph API.

Can you let me know if I am missing anything here?

Regards,
Japneet

Answer 1

Hi @Japneet Sahni ,

As per this document, mailNickname is only returned on $select while using v1.0

Hope this helps.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have further questions about this answer, please click "Comment".

Answer 2

mailNickname does not correspond to any of the default claims, so if you want it represented in the token, you need to issue a custom claim: https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims

Answer 3

@Vasil Michev @Bhanu Kiran : I have added mailnickname as an optional claim but it still says that this claim is not supported

"optionalClaims": {  
	"idToken": [  
		{  
			"name": "email",  
			"source": null,  
			"essential": false,  
			"additionalProperties": []  
		},  
		{  
			"name": "upn",  
			"source": null,  
			"essential": false,  
			"additionalProperties": []  
		},  
		{  
			"name": "groups",  
			"source": null,  
			"essential": false,  
			"additionalProperties": []  
		},  
		{  
			"name": "mailnickname",  
			"source": null,  
			"essential": false,  
			"additionalProperties": []  
		}  
	],  
	"accessToken": [],  
	"saml2Token": []