OIDC embeddedAttributes

[Wessel, Keith]

Thanks, Scott. Sadly, I'm still getting no claims place to the IDToken other than the reserved OIDC claims. The client is requesting the mail scope which should trigger the email claim being placed to the token. The client is also explicitly requesting the university ID number which is also in my list of claims permitted to go to the IDToken.

The oidc.properties file mentions idp.oidc.embeddedAttributes; I tried setting this, but it did nothing. I then looked in the source code, and I saw mention of idp.oidc.encodedAttributes. There doesn't seem to be an idp.oidc.embeddedAttributes, assuming I'm looking at the right version of the source. So, I changed my oidc.properties to reference idp.oidc.encodedAttributes instead, but still nothing. What is the secret to getting claims added to the IDToken when those claims are in a requested scope or are explicitly requested? Everything's getting to the userinfo response fine. So, I'm clearly overlooking something here.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, July 22, 2021 7:13 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: OIDC embeddedAttributes

On 7/21/21, 6:15 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    One other question about the OIDC claim properties: I presume the values in those properties should be IDs
> in the attribute resolver configuration, not the OIDC clain names that they'l resolve to. So, if my attribute
> definition with id="mail" is encoded to the OIDC claim "email", I should list mail and not email in the property.

Always attribute IDs.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!o3bzEslisG4ULMYCVk0NAu7NEfFfGr65u6FadM91eMBpBetnI55Hs0bsQi6fiQ_zuQ$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net