OIDC embeddedAttributes

[Wessel, Keith]

Never min d, I just went back and read the comments again:

# "Embedded" attributes are encoded and encrypted into the access token
# "Always included" attributes are forced into ID tokens for all response_types

I had forgotten that claims could be added to the access token. So, only question is does "alwaysIncludedAttributes" mean they're always there whether they were requested or not? If so, how would one say "this claim can go in the IDToken if it was requested or was part of a requested scope"? This would be the equivalent of adding placeToIDToken="true" on an attribute definition in V2 of the extension.

Or does alwaysIncludedAttributes mean it's included if it's requested? I don't want to go releasing the university ID number in every IDToken if only certain apps need it. I can do a relying party override if I have to, but I'm trying to reproduce the behavior I had in extension V2 without doing that.

Keith


-----Original Message-----
From: Wessel, Keith 
Sent: Thursday, July 22, 2021 1:40 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: OIDC embeddedAttributes

Scott,

Thanks.

I had interpreted alwaysIncludeAttributes as claims to be included whether they were requested or not. I thought that encodedAttributes (a.k.a. embeddedAttributes) was attributes to include in the IDToken if they were requested or they were in a scope that was requested, or if the attribute resolver config explicitly released them. If alwaysIncludeAttributes includes them, what does encodedAttributes do?

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, July 22, 2021 1:33 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: OIDC embeddedAttributes

On 7/22/21, 12:37 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    The oidc.properties file mentions idp.oidc.embeddedAttributes; I tried setting this, but it did nothing.

There was a bug, we misnamed it. JOIDC-49. It's idp.oidc.encodedAttributes. The next patch will support either for compatibility and changes the default file.

> What is the secret to getting claims added to the IDToken when those 
> claims are in a requested scope or are explicitly requested?

I think you have to use idp.oidc.alwaysIncludedAttributes for that. The spec basically says that nothing much is in the ID token when the back channel is used so there's a setting to force them there if you want them, along with another setting to keep them out of the userinfo token if you want that too.

The whole thing confuses me, but I had to work through all the settings to get the configuration wiring in place and that was my understanding of how it all worked.

-- Scott


--
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!tgOKm12SoQrrs5LyTOlfZRkIeX4WUPU-7Dka6mxLKrBWDV2MwTHOSUM9QE1cdndkTw$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net