# Mapping claims from JWT to a Discourse User via login plugin **URL:** \ **Category:** SSO\ **Tags:** oauth2, openid-connect\ **Created:** [March 14, 2024, 12:40pm UTC](https://meta.discourse.org/t/mapping-claims-from-jwt-to-a-discourse-user-via-login-plugin/299334 "2024-03-14T12:40:23Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![jrack](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jrack/32/326934_2.png) [@jrack](https://meta.discourse.org/u/jrack)\ **Post date:** [March 14, 2024, 12:40pm UTC](https://meta.discourse.org/t/mapping-claims-from-jwt-to-a-discourse-user-via-login-plugin/299334/1 "2024-03-14T12:40:23Z")
So been trying to find an SSO plugin that allows me to leverage the claims coming from my IdP for my Discourse Users. In OIDC plugin you are pretty much locked to the userinfo endpoint. That’s not bad, but I was trying to use other info from our identity store and the userinfo result can’t be adjusted. I had tried to force OIDC plugin to use the id\_token\_info to fabricate the user, but no luck. I jumped back to the [oauth plugin](https://github.com/discourse/discourse-oauth2-basic), but on the surface it looks to have the same basic restriction which is it depends on user information from a specific endpoint. Working to see if I can find one that returns the content of the JWT claims, but that’s not really a normal use case so not expecting much. I originally thought that the “callback userinfo paths” on the oauth basic could be used to map the claims into the User, but always seem to get nulls in the response and failed insert. I can decode the token from the IdP and see the correct claims and in this case at the root of the JSON like like iss, exp, etc, but can’t connect them to the ActiveRecord side. I am looking at [jwt](https://github.com/discourse/discourse-jwt/tree/main) but it doesn’t seem to have the mapping of claims to user at all. Basically if you get a 200 you are good which isn’t what i was looking for either. I also found omniauth-jwt]([GitHub - discourse/discourse-omniauth-jwt: An OmniAuth strategy that uses JSON Web Token for Single Sign-On · GitHub](https://github.com/discourse/discourse-omniauth-jwt)) which seems to be closer to my goal though doesn’t look to be a plugin nor actively maintained. Something maybe I could fix, but a bigger bite than i was hoping to take. Anyone point me in a direction for a currently maintained plugin to map JWT claims to a User or where I might be going wrong with one of the existing plugins? --- _[View the full topic](https://meta.discourse.org/t/mapping-claims-from-jwt-to-a-discourse-user-via-login-plugin/299334)._