OIDC attributes in id-token

[Ulf Seltmann]

Hello,

I need to add a webservice that expects the attributes email and preferred_username in the id_token. 
After some searching i found the option "idp.oidc.alwaysIncludedAttributes" in the docs[1]:

# "Always included" attributes are forced into ID tokens for all response_types
#idp.oidc.alwaysIncludedAttributes =

Unfortunately setting this to 

idp.oidc.alwaysIncludedAttributes=preferred_username,email

did not change anything. The audit stell shows none of the attributes in the id-token:
09:19:46.835 [INFO] :qtp1286783232-34: (Shibboleth-Audit.OIDC.Token) - 194.95.245.101|2024-10-
23T07:19:46.722195335Z|2024-10-23T07:19:46.835448218Z|us66zumi|_c88810a172aa19774e42bf821ec1f2ae|||2024-10-
23T07:19:46.734453278Z|at_hash,sub,aud,auth_time,iss,exp,iat,nonce,sid|ffb43b1eaf0538893e739179e0872bf0d42bac2da7a260fb2
15434a2dc44a3b4||false|||TokenRequest|OIDCTokenResponse|||||mod_auth_openidc

Attribute release generally works. When i test it with as service that leverages the userinfo-request the claims are fulfilled.

What did I miss?

[1]: https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken#Configuration


Thanks in advance,
cheers

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6575 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20241023/9c143c25/attachment.p7s>