Adding of custom claim not working in Jans server version 1.1.5

[zackbum]

Hi,

I am trying to add custom attribute in order to have it as additional user claim. I followed the Jans 1.1.5 documentation but got the error 406. I had already defind newClaim in 77-customAttributes.ldif but the error still occurs.

In addition, I am not able to see all active attributes in user claims (see photo). Any suggestions to make all visible?
Thanks

[jgomer2001]

besides restarting opendj, try restarting tui as well...

[zackbum]

Hi @jgomer2001
Thanks for the tip. I had restarted Jans server several times and the error 406 still occurs. Please see content of my 77-customAttributes.ldif file. I wanted to add objectguid from Active Directory as custom attribute. I have checked and objectguid is in the opendj ldap schema but not registered as inum in jansperson. The guideline add custom attribute seems to be not clear. When I start Jans Link the objectguid was populated from AD for each user in Jans TUI but objectguid is not available in Auth add Attributes and under user add Claims.

Thanks

dn: cn=schema
objectClass: top
objectClass: ldapSubentry
objectClass: subschema
cn: schema
attributeTypes: ( 1.3.6.1.4.1.48710.1.3.376 NAME 'objectguid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 DESC 'A globally unique identifier assigned by Active Directory Domain Services when the object instance is created.' SINGLE-VALUE USAGE userApplications X-ORIGIN 'Jans created attribute' )
objectClasses: ( 1.3.6.1.4.1.48710.1.4.101 NAME 'jansCustomPerson' SUP ( top ) AUXILIARY MAY ( telephoneNumber $ objectguid $ mobile $ carLicense $ facsimileTelephoneNumber $ departmentNumber $ employeeType $ cn $ sn $ st $ uid $ givenName $ middleName $ nickname $ manager $ street $ postOfficeBox $ employeeNumber $ preferredDeliveryMethod $ roomNumber $ secretary $ userPassword $ homePostalAddress $ l $ postalCode $ description $ title $ jansStatus $ memberOf $ displayName $ mail $ emailVerified $ jansAdminUIRole ) X-ORIGIN 'Jans - Custom persom objectclass' )

[jgomer2001]

Did you add the attribute in TUI too (Alt + b) ? Sorry to ask but the screenshots don't load for me

[zackbum]

Yes, I had tried to add custom attribute "objectguid" in TUI under "Auth Server" "Attributes". It does not matter what I put in the GUI of "add attribute", when I click "Save" the TUI throws the error 406 "Attribute is not defined in DB schema". But the attribute "objectguid" is in schema janscustomattributes. Even if I delete the already available custom attribute "title" from the Auth Server attributes and I try to recreate it, the error 406 is thrown. See my "add attribute" setup below. Hope I have not crashed my opendj DB :)
Name: objectguid
SAML1 URI: urn:jans:dir:attribute-def:objectguid
SAML2 URI: urn:oid:1.3.6.1.4.1.48710:1.3.379
Display Name: objectguid
Data Type: binary
Edit Type: admin
View Type: admin, user
Multivalued: unchecked
Claim Name: objectguid
Include in SCIM Extension: unchecked
Description: objectguid
Status: active
URN: urn:jans:dir:attribute-def:objectguid
Enable Custom Vaidation: unchecked

[zackbum]

See output from opendj logs:
access:[26/Mai/2025:17:44:23 +0200] SEARCH REQ conn=15 op=30 msgID=31 base="ou=attributes,o=jans" scope=sub filter="(&(&(objectClass=jansAttr))(jansAttrName=objectguid))" attrs="jansSAML1URI,jansMultivaluedAttr,jansClaimName,jansScimCustomAttr,displayName,jansSAML2URI,jansAttrName,description,inum,jansAttrTyp,seeAlso,jansValidation,jansHideOnDiscovery,urn,jansAttrViewTyp,jansStatus,jansAttrEditTyp,jansAttrOrigin,jansNameIdTyp,jansAttrUsgTyp,jansSourceAttr,jansTooltip"
ldap-access.audit.json:{"eventName":"DJ-LDAP","client":{"ip":"127.0.0.1","port":54688},"server":{"ip":"127.0.0.1","port":1636},"request":{"protocol":"LDAPS","operation":"SEARCH","connId":15,"msgId":31,"dn":"ou=attributes,o=jans","scope":"sub","filter":"(&(&(objectClass=jansAttr))(jansAttrName=objectguid))","attrs":["jansSAML1URI","jansMultivaluedAttr","jansClaimName","jansScimCustomAttr","displayName","jansSAML2URI","jansAttrName","description","inum","jansAttrTyp","seeAlso","jansValidation","jansHideOnDiscovery","urn","jansAttrViewTyp","jansStatus","jansAttrEditTyp","jansAttrOrigin","jansNameIdTyp","jansAttrUsgTyp","jansSourceAttr","jansTooltip"]},"transactionId":"0","response":{"status":"SUCCESSFUL","statusCode":"0","elapsedTime":1,"elapsedTimeUnits":"MILLISECONDS","nentries":0},"timestamp":"2025-05-26T15:44:23.543Z","_id":"324fe7cc-8a44-43a4-886b-b0a88f303ad3-1747"}

[jgomer2001]

But the attribute "objectguid" is in schema janscustomattributes

So you mean that you can successfully add a user manually with an LDAP client and have that attribute set ? (that would be in ou=jansPerson,o=jans or something like that)

Suggestions:

• Check jans tui logs to see the actual error details
• Try adding objectguid attribute entry under ou=attributes,o=jans. Take as example an attribute in jansCustomPerson that already works

[zackbum]

Hi @jgomer2001,

here is what I have done:

1. create 77-customAttribute.ldif file to create custom attribute "objectguid" in opendj schema
2. opened opendj control panel to view if "objectguid" is in schema under jansCustomPerson (true)
3. tried to add attribute to Jans Server under "Auth Server" "add Attribute". Save result in error 406 objectguid is not in DB schema
4. tried to create attribute.json file with "objectguid" details and load it with jans-cli and option --post-attributes --data: result in error 406 objectguid is not in DB schema
5. Tried brut force method and opened opendj control panel and duplicated mail attribute under ou=attributes,o=jans Privided a new hex inum and edited other options which apply to custom attribute "objectguid": Save was successful
6. Looked into jans tui in Auth Server attributes and "objectguid" is listed there as active
7. Looked under users und Add Claims: no "objectguid" is listed there as selectable claim
8. Summary: It is not possible to add custom attribute via Jans tui and Jans cli (maybe a bug?) It is not possible to add custom attribute to user claims (also a bug?)
9. How I can check if "objectguid" is now correctly used for user authentication?

Thanks for support :)

[jgomer2001]

I cannot explain the failure in steps 3-4. Adding an attribute is a very common task and should not fail...

However my theory is that objectguid is having special treatment. In your server see file /etc/jans/conf/jans-ldap.properties...

I guess it does not harm to treat the attribute as a plain string right? you can try the following:

• Comment the line starting with binaryAttributes in the properties file
• Change your customAttributes ldif file so string syntax is used, ie. 1.3.6.1.4.1.1466.115.121.1.15 instead of 1.3.6.1.4.1.1466.115.121.1.5. Backup the file first please
• Remove the entry you created under ou=attributes,o=jans
• Restart everything
• See if TUI allows you to create the attribute and add the claim
• If still not shown, instead of duplicating "mail", try with an attribute which is listed already in the "add claims" window, like "secret question". Then do a restart.

If it does not work, try adding another string attribute, not objectguid. See how it behaves

If you ever make it work, the next step is going to 'Auth Server' > 'Scopes', search profile and add the claim. That way, the attribute will be available in the user info (after authentication).

[zackbum]

Hi @jgomer2001,

Good news, I could successfully add custom attribute objectguid to Auth Server Attributes via Jans tui :)
Here is what I have done:

1. backuped file 101-jans.ldif with command cp -p 101-jans.ldif{,.bak}
2. dupicated entries for secretAnswer and replaced secretAnswer with objectguid and a free oid
3. Commented the line starting with binaryAttributes in the jans-ldap-properties file
4. Restarted all
5. opened jans tui and added atrribute with only name and display name (objectguid, object_Guid) inserted and save result with no error and entry for objectguid was created
6. Closed jans tui and re-open it and now I can find "objectguid" in user claims for adding :)
7. I have done all the above mentioned with file 77-customAttributes.ldif and I get error 406 again
8. I assume that something is wrong with the janscustomattributes setup. You will find a typo in the default 77-customAttributes.ldif file coming from the jans server installation.
9. If you look at the line X-ORIGIN 'Jans - Custom persom objectclass' ) Person is written with a "m". Not sure if this is correct.
   If not please provide correct X-ORIGIN for janscustomperson
   In addition, I will need correct SAML URIs and URN for objectguid. Could you please ask the GLUU experts how these should look like in Jans Server or Gluu Flex as objectguid is used to set up Microsoft OFFICE 360 authentication.

Thanks for great support :)

[jgomer2001]

Ok, that's great.

The typo is just that - a typo. Regarding point 8, that's interesting, since ldap support was removed there will be no fix for that.

@mzico can you advise what values to provide in TUI when adding Microsoft objectGUID as a custom attribute, specifically URI/URN stuff?

[mzico]

@zackbum : I see you are using LDAP in Janssen, we don't support it anymore.