OIDC embeddedAttributes

[Cantor, Scott]

On 7/22/21, 12:37 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    The oidc.properties file mentions idp.oidc.embeddedAttributes; I tried setting this, but it did nothing.

There was a bug, we misnamed it. JOIDC-49. It's idp.oidc.encodedAttributes. The next patch will support either for compatibility and changes the default file.

> What is the secret to getting claims added to the IDToken when those claims are in a requested scope or are
> explicitly requested?

I think you have to use idp.oidc.alwaysIncludedAttributes for that. The spec basically says that nothing much is in the ID token when the back channel is used so there's a setting to force them there if you want them, along with another setting to keep them out of the userinfo token if you want that too.

The whole thing confuses me, but I had to work through all the settings to get the configuration wiring in place and that was my understanding of how it all worked.

-- Scott