OIDC/OAUTH additional claims in access_token

[BJörn Lambertz]

Hi Henri,

On 8/29/24 17:22, Henri Mikkonen wrote:
> This property is used for configuring the claims whose values will get
> encoded inside the opaque tokens, actually already to the
> authorization code. The attributes are referred with attribute IDs, so
> if you wanted to encode preferred_username and you're using the
> default mappings, you should refer to 'uid'.
Ah I see, thank you for clarification. We're working with JWT, so I'll
disable idp.oidc.encodedAttributes
> Anyway, that's not what you want if you're aiming at including claims
> in the JWT access token. The client needs to indicate the resource
> server for which they want to consume the access token: if they're not
> indicating it, then the access token is solely targeted at the OP
> itself (i.e. the userinfo endpoint). In those cases OP doesn't include
> any "extra" claims to the JWT access token. I believe that's your case
> currently?
Exactly, I told them to include resource parameter the other day because
of audience topic, so that will also help with the claims in
access_token. Very helpful!
> The client can use the resource parameter as defined in RFC 8707. That
> resource needs to be trusted by the OP in the same way as other
> RPs/clients, i.e. it needs to have a metadata entry with matching
> client_id. You need to add the scopes which covers the claims that you
> want to be included in the JWT. Finallly, you also need to add a
> mapping between the requesting client/RP and the resource server via
> audience, see [1].
>
> The OAUTH2.TokenAudience profile configuration is used for configuring
> the access token for the extra audiences. You probably want to start
> with something like the following:
>
> <bean parent="OAUTH2.TokenAudience" p:encryptionOptional="true"
> p:accessTokenType="JWT"/>

That matches what I configured for the public clients:

             <bean parent="RelyingPartyByName"
c:relyingPartyIds="#{{'client1', 'client2', 'client3' }}" >
                <property name="profileConfigurations">
                  <list>
                       <bean parent="OIDC.SSO"
p:postAuthenticationFlows="#{{'terms-of-use', 'attribute-release'}}" />
                       <bean parent="OAUTH2.Token" p:forcePKCE="true"
p:tokenEndpointAuthMethods="none" p:allowPKCEPlain="true"
p:accessTokenType="JWT" p:refreshTokenType="JWT" />
                       <bean parent="OAUTH2.TokenAudience"
p:encryptionOptional="true" p:accessTokenType="JWT" />
                       <ref bean="OIDC.UserInfo" />
                       <ref bean="OAUTH2.Revocation" />
                       <ref bean="OAUTH2.Introspection" />
                       <ref bean="OIDC.Logout"/>
                   </list>
                </property>
             </bean>

And for completeness the RP config in json:

[
   {
     "scope":"openid email profile offline_access",
     "redirect_uris":["url1"],
     "client_id":"client2",
     "audience":["api_url1", "api_url2"],
     "response_types":["code"],
     "grant_types":["authorization_code", "refresh_token"],
     "token_endpoint_auth_method":"none"
   }
]

So I think when external company includes resource parameter in their
request, we should be fine.

Thank you, Björn



------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Ir. Pieter Jansens
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------