Shib Idv v4.3.3 with OIDC

[Hall, Gerry]

I have added OIDC support to our Shibboleth IdP (v4.3.3) and everything appears to work as expected.
I am trying to pass our serialNumber attribute to the service as oidc_serialNumber.

Using the scoped configuration below, works as expected and the user’s serialNumber with scope is passed as for example P1234567 at emory.edu<mailto:P1234567 at emory.edu>.
<!--  Works but adds @emory.edu scope -->
<AttributeDefinition id="oidc_serialNumber" xsi:type="Scoped" scope="%{idp.scope}"
        activationConditionRef="shibboleth.oidc.Conditions.PublicRequired">
    <InputAttributeDefinition ref="serialNumber" />
    <AttributeEncoder xsi:type="oidc:OIDCScopedString" name="sub" />
</AttributeDefinition>

But what I really need is the just the serialNumber minus the scope.
I have tried several configurations without success.
Here is one example:
<!— Does not work.  Nothing is passed for the oidc_serialNumber à
<AttributeDefinition id="oidc_serialNumber" xsi:type="Simple" >
    <InputAttributeDefinition ref="serialNumber" />
    <AttributeEncoder xsi:type="oidc:OIDCString" name="oidc_serialNumber" />
</AttributeDefinition>

Here is the attribute filter:
    <AttributeFilterPolicy id=" SomeServiceOrgNonProd _OIDC">
        <PolicyRequirementRule xsi:type="Requester" value="SomeServiceOrgNonProd" />

        <AttributeRule attributeID="oidc_serialNumber">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>

Here is the OIDC json config:
        "client_id": " SomeServiceOrgNonProd ",
        "response_types": ["code"],
        "scope": "openid profile email",
        "redirect_uris": ["https://someservice.org/.auth/login/nonprod-e2-cod-web-oidc/callback"],
        "client_secret": "1234567890aaaaa"

I have also tried just passing the serialNumber which also does not work.
I have read the docs here https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879159/OPAttributeResolution as well as docs linked to from that page.

I see no errors in the IdP logs.

What am I doing wrong?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241003/f0dba126/attachment.htm>