Add email claim to Access Token oauth2

[Henri Mikkonen]

On 10.10.2025 17.15, Pedro Miguel Marques via users wrote:
> Hi, thanks for your reply.
> 
> Yes, it seems that the app is not behaving  like an openid app, but like 
> an app that makes plain oauth2 authorization requests.
> 
> In that case, after removing openid from scope and 
> setting requireAuthenticationRequestPredicate to false i'm getting the 
> warning *"unable to produce a viable "sub" claim"* and the 
> error*"Subject may not be null" . *Removing the openid from scope, is 
> supposed to not produce a sub claim, correct?
> 
> What am I missing here?

Check your attribute filtering configuration. It looks like it's not 
currently releasing the subject/sub claim to the RP if openid scope is 
not involved.

The example filtering rules provided in the distribution package 
contains a filtering policy with id "OAUTH_SUBJECT". That should cover 
the OAuth2 sequences not involving openid-scope.

BR,
Henri.