Support additional Microsoft attribute names

In #420766 (closed), a change was introduced (via !135770 (merged)) that was meant to make it easier for users of Microsoft Azure or Entra to configure SAML.

However, Support is seeing tickets because users are using the namespace (either http://schemas.microsoft.com/ws/2008/06/identity/claims or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/), but with the claim email instead of emailaddress. Example:

  • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email

This then causes them to receive error messages about a missing email address attribute (SAML response didn't contain email address.), because it doesn't match http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

In the interest of support ticket deflection and making the product more robust, I propose one of the following:

  • Support for the email claim with either of the above namespaces: either http://schemas.microsoft.com/ws/2008/06/identity/claims/ or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/
  • Better documentation around this feature: if the namespace is left blank, then email works fine. This should be documented.
Edited by Michael Gibson