OIDC/OAUTH additional claims in access_token

[Henri Mikkonen]

Hi Björn,

On 29.8.2024 17.36, Lambertz, Björn via users wrote:
> I set this config option in oidc.properties:
> 
> # Special claim handling rules
> # "Encoded" attributes are encrypted and embedded into the access token
> idp.oidc.encodedAttributes = preferred_username

This property is used for configuring the claims whose values will get 
encoded inside the opaque tokens, actually already to the authorization 
code. The attributes are referred with attribute IDs, so if you wanted 
to encode preferred_username and you're using the default mappings, you 
should refer to 'uid'.

Anyway, that's not what you want if you're aiming at including claims in 
the JWT access token. The client needs to indicate the resource server 
for which they want to consume the access token: if they're not 
indicating it, then the access token is solely targeted at the OP itself 
(i.e. the userinfo endpoint). In those cases OP doesn't include any 
"extra" claims to the JWT access token. I believe that's your case 
currently?

The client can use the resource parameter as defined in RFC 8707. That 
resource needs to be trusted by the OP in the same way as other 
RPs/clients, i.e. it needs to have a metadata entry with matching 
client_id. You need to add the scopes which covers the claims that you 
want to be included in the JWT. Finallly, you also need to add a mapping 
between the requesting client/RP and the resource server via audience, 
see [1].

The OAUTH2.TokenAudience profile configuration is used for configuring 
the access token for the extra audiences. You probably want to start 
with something like the following:

<bean parent="OAUTH2.TokenAudience" p:encryptionOptional="true" 
p:accessTokenType="JWT"/>

BR,
Henri.

[1] 
https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile