Add email claim to Access Token oauth2

[Pedro Miguel Marques]

Hi,

Apologize for returning to this.

  Is there any way to include the claims defined in the scope directly in
the jwt access token, without having to specify the resource parameter in
the authentication request? The third-party app we're integrating with
Shibboleth's OpenID layer is built to read user-related claims like email
straight from the jwt access token and doesn't support the resource
parameter in the auth request.


thanks in advance for a reply

Best regards

Pedro



Cantor, Scott <cantor.2 at osu.edu> escreveu (quarta, 24/09/2025 à(s) 15:01):

> > Because the application from a third party, that we are
> > integrating with our OIDC OP, needs to get the email claim
> > from the acessToken. Does it make sense? It should be like
> > this?
>
> The only case in which you would need the claim would be if that system
> you're logging into is then going to use the access token with a third
> system via an API that requires an OAuth token and will be verifying the
> JWT itself and wanting the claim (and email isn't the right information
> anyway, that's not an identifier).
>
> If there are only two systems (OIDC client, OP) there is no scenario in
> which it's appropriate for that system to be looking at the access token,
> it's an opaque blob to any client.
>
> -- Scott
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251009/f3a9d710/attachment.htm>