OIDC/OAUTH additional claims in access_token

[Lambertz, Björn]

Hi,

 

on a non-production IdP we're fiddling around with the authorization_code
flow with PKCE, sometimes referenced as public client or SPA (Single Page
Application). An external company is trying to implement OIDC Login against
our IdP for their mobile apps.

 

Now they asked to include some claims in the access_token. Still not sure if
I want to run this in production, but for testing purposes ok.

 

I set this config option in oidc.properties:

# Special claim handling rules

# "Encoded" attributes are encrypted and embedded into the access token

idp.oidc.encodedAttributes = preferred_username

 

According to external company, AccessTokens they get, contain these:

sub

aud

root_jti

auth_time

scope

iss

for_op

exp

iat

client_id

jti

sid

 

In IdP Debug Logs it also looks like preferred_username is not included (I
removed most values):

Profile Action BuildAccessToken: Claims stored to JWT access token:
{"sub":"","iss":"","cnsnt":true,"prncpl":"","type":"at","nonce":"","sid":"",
"aud":"","root_jti":"","auth_time":,"scope":"openid profile
offline_access","exp":,"iat":,"jti":""}

 

Reviewed documentation if further steps are necessary, nothing jumped me.
Any ideas why preferred_username is not included in access_token?

 

Thank you, Björn

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240829/6f9f5cd4/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6857 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240829/6f9f5cd4/attachment.p7s>