OIDC claims missing after upgrade to IdP 4.1

[Wessel, Keith]

Hi, all,

I upgraded to 4.1 and moved to the new OIDC plugin, making what I thought was all of the necessary config changes in the process for the new plugin architecture. But I'm not getting (hardly) any claims released to my clients. I've got a client requesting profile, email, address, and phone along with the obvious openid. All it's getting back is sub and a local claim, uiucedu_edu_person_entitlement based on eduPersonEntitlement which has a value that gets released to everyone.

When logging in, the consent interface displays all of the attributes that it should normally get: display name, first and last name, address, phone, email, etc. But the audit log entries for the userinfo request only logs sub and eduPersonEntitlement. The token request entry in the audit log records all of the reserved OIDC claims, but nothing else.

This was working in 4.0 with V2 of the OIDC extension. I made the necessary schema changes to my attribute filter and attribute resolver config to match the new namespace. Any thoughts on what I might be missing?

The log doesn't seem to be telling me much, and I can't figure out what class to start logging to turn up the OIDC attribute resolution and filtering to debug. Even a pointer on that would help at this point.

Thanks,
Keith