[JIRA] (JOIDC-100) Releasing IAT, EXP and NBF claims from the UserInfo endpoint

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-100 ( https://shibboleth.atlassian.net/browse/JOIDC-100?atlOrigin=eyJpIjoiOTI0MjE0NTMyZGQ4NDAzNGFlMGEzMDRhMDY1ZjI4OGUiLCJwIjoiaiJ9 )

Re: Releasing IAT, EXP and NBF claims from the UserInfo endpoint ( https://shibboleth.atlassian.net/browse/JOIDC-100?atlOrigin=eyJpIjoiOTI0MjE0NTMyZGQ4NDAzNGFlMGEzMDRhMDY1ZjI4OGUiLCJwIjoiaiJ9 )

Actually, I checked and these are NOT reserved claims for the UserInfo endpoint, precisely because this isn’t actually a security token / JWT. We actually differentiate that case. So whatever you’re hitting, it wasn’t that, and this asObject trick shouldn’t really be connected. I suspect something else is wrong or was wrong.

Given that, it would be good to figure that out and ideally leave this to custom claims, as you originally were attempting. That keeps us out of it, which I would prefer given the illegitimacy of this behavior under the spec.

It is also possibly BTW to override the reserved claim names for each enpdoint, there are beans for each one:

* shibboleth.oidc.UserInfoReservedClaimNames
* shibboleth.oidc.AccessTokenReservedClaimNames
* shibboleth.oidc.IDTokenReservedClaimNames

There are also versions of each defined with “Default” in the names to allow merging in your own values, or the new bean can just override the original entirely.

( https://shibboleth.atlassian.net/browse/JOIDC-100#add-comment?atlOrigin=eyJpIjoiOTI0MjE0NTMyZGQ4NDAzNGFlMGEzMDRhMDY1ZjI4OGUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-100#add-comment?atlOrigin=eyJpIjoiOTI0MjE0NTMyZGQ4NDAzNGFlMGEzMDRhMDY1ZjI4OGUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/e13384e4/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-c8dd3f44-60d5-4fc4-9817-7eb0c1947cf1
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/e13384e4/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-3d53e54f-10a4-4ba4-8a24-eec600c6cf98
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/e13384e4/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-c99f3350-5223-49ee-bde9-00d254248527
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/e13384e4/attachment-0005.png>