Support additional Microsoft attribute names
In #420766 (closed), a change was introduced (via !135770 (merged)) that was meant to make it easier for users of Microsoft Azure or Entra to configure SAML.
However, Support is seeing tickets because users are using the namespace (either http://schemas.microsoft.com/ws/2008/06/identity/claims or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/), but with the claim email instead of emailaddress. Example:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email
This then causes them to receive error messages about a missing email address attribute (SAML response didn't contain email address.), because it doesn't match http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
In the interest of support ticket deflection and making the product more robust, I propose one of the following:
- Support for the
emailclaim with either of the above namespaces: eitherhttp://schemas.microsoft.com/ws/2008/06/identity/claims/orhttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/ - Better documentation around this feature: if the namespace is left blank, then
emailworks fine. This should be documented.