> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/modify-user-claim-values.md).

# Modify User Claim Values

### Overview

The OE claims `orgId`, `walletId`, `signerServer`, `wellKnownUrl` and, on the Data Space Operator, `upstream_idp` are stored as attributes of the user and emitted through the OE scope mappings.

For detail-oriented flow illustration, please consult [Sequence Flow](#sequence-flow).

### Procedure

1. Authenticate in Authentik Dashboard as `akadmin` , Administrator account which was created at [initial setup](/infrastructure/user-management-package/deployment-steps/post-installation-steps.md#set-the-authentik-server-administrator-account).
2. Navigate to **Directory → Users** and search for the user.
3. Select the user and select **Edit**.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FRiYVdIlPIAjnSKn6fIlq%2FScreenshot%202026-09-09%20at%2002.12.50.png?alt=media&amp;token=f4a1a092-05d8-4b1f-863c-dba107bc506a" alt=""><figcaption></figcaption></figure>

4. Update the **Attributes** field, keeping all attributes that must be retained:

{% code overflow="wrap" %}

```yaml
orgId: ocean_enterprise
walletId: "3"
signerServer: https://<host>:8443
wellKnownUrl: https://<idp-host>:9443/application/o/<app-slug>/.well-known/openid-configuration
upstream_idp: <app-slug>
```

{% endcode %}

5. Select **Save Changes**.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FgxHgowXVKhbRVW2SZ2cw%2FScreenshot%202026-09-09%20at%2002.14.06.png?alt=media&amp;token=53da7410-cac8-4b15-b906-6f03b1063d2f" alt=""><figcaption></figcaption></figure>

### Verification

1. The **Attributes** section of the user shows the intended values.
2. After the user authenticates again, the decoded JWT contains `orgId`, `walletId`, `signerServer`, `wellKnownUrl`, `upstream_idp`, `name` and `email`.

### Notes

* Federated shadow users must not be corrected on the Data Space Operator. Their attributes are rewritten from the upstream token at every federated login. Correct the Participant user or the Participant scope mappings instead.
* A missing `upstream_idp` attribute produces the fallback value `unknown3` in the token. Treat any `unknown*` value as a configuration error.

### Appendix

#### Sequence Flow

```mermaid
sequenceDiagram
    actor OA as Administrator
    participant UI as Authentik<br>Service
    participant PG as Authentik<br>Database
    actor U as Directory User

    OA->>UI: Open Directory → Users and select the user
    OA->>UI: Edit the attributes with the new OE claim values
    UI->>PG: Save the updated attributes on the user
    PG-->>UI: User updated
    UI-->>OA: New values displayed

    U->>UI: Authenticate again to the OE application
    UI->>PG: Read the attributes of the user
    PG-->>UI: Updated OE claim values
    UI-->>U: Token carrying the updated OE claims
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.oceanenterprise.io/operational-guidelines/user-directory-management/modify-user-claim-values.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.