# OpenID Connect issue with Azure AD

**URL:** <https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706>\
**Category:** SSO\
**Created:** [January 3, 2019, 2:11pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706 "2019-01-03T14:11:01Z")\
**Posts on this page:** 1\
**Showing post:** 18

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [January 4, 2019, 4:39pm UTC](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706/18 "2019-01-04T16:39:46Z")

</div>

> [@Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632/25):
>
> I also found [this post](https://stackoverflow.com/questions/30983694/get-the-users-email-address-from-azure-ad-via-openid-connect), which may speak to the problem?

From that link:

> Note that the e-mail address may not be returned in an `email` claim: in my case (once I got it working) it’s coming back in a `name` claim.

That is indeed what we’re seeing - so it sounds like AD does not quite comply with the openid-connect specification 😢. If you can manage to configure AD to return it in the email claim, that would be the best solution. However, it looks like even microsoft’s own ruby implementation hacks around the problem:

> <https://github.com/AzureAD/omniauth-azure-activedirectory/blob/master/lib/omniauth/strategies/azure_activedirectory.rb#L59>

You could try [GitHub - discourse/discourse-azure-ad · GitHub](https://github.com/discourse/discourse-azure-ad) instead (which uses [GitHub - marknadig/omniauth-azure-oauth2 · GitHub](https://github.com/KonaTeam/omniauth-azure-oauth2) under the covers)

If you really want to use the openid-connect plugin, you could write another plugin to ‘trick’ our openid-connect plugin into using the `upn` for the email address. Note that this would not be a ‘supported’ configuration, but if you have some ruby experience you could do something like this (not tested):

```plaintext
after_initialize do
  module SwapNameEmail
    def after_authenticate(auth_token, existing_account: nil)
      auth_token[:info][:email] = auth_token[:extra][:raw_info][:upn]
      super
    end
  end

  ::OpenIDConnectAuthenticator.class_eval do
    prepend SwapNameEmail
  end  
end

```

---

_[View the full topic](https://meta.discourse.org/t/openid-connect-issue-with-azure-ad/105706)._