OIDC Claim Release Problems

[Bryan K. Walton]

We have a working Shibboleth IdP that has been doing SAML for many
years.  We are trying to add OIDC/Oauth to this server.  I've followed
the instructions found here:

https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP

I've setup a temporary OIDC application on my workstation that uses
mod_auth_openidc.

Authentication appears to be working to the mod_auth_openidc protected
web page.  Our Shibboleth IdP is releasing a pairwise version of the
required subject claim and I see that in my application's Apache logs
as the remote user.

However, I'm trying and failing to get my remote user changed to
email.  I've set my mod_auth_openidc config to use email for
"OIDCRemoteUserClaim".  I also have OIDCScope set to:
"openid email profile".

Now, when I login to the proteced application, I
get:

[Tue Sep 02 13:38:10.399527 2025] [auth_openidc:warn] [pid 1870717:tid
1870717] [client 10.1.88.51:39498] oidc_get_remote_user: JSON object did
not contain a "email" string
[Tue Sep 02 13:38:10.399634 2025]
[auth_openidc:error] [pid 1870717:tid 1870717] [client 10.1.88.51:39498]
oidc_response_set_request_user: OIDCRemoteUserClaim is set to "email",
but could not set the remote user based on the requested claim "email"
and the available claims for the user
[Tue Sep 02 13:38:10.399662 2025] [auth_openidc:error] [pid 1870717:tid 
1870717] [client 10.1.88.51:39498] oidc_response_process: remote user 
could not be set

In my IdP's attribute-filter.xml, I have the following:

<AttributeFilterPolicy id="OPENID_SCOPE_EMAIL">
	<PolicyRequirementRule xsi:type="oidc:OIDCScope" value="email" />
	<AttributeRule attributeID="mail">
		<PermitValueRule xsi:type="ANY" />
	</AttributeRule>
	<AttributeRule attributeID="email_verified">
		<PermitValueRule xsi:type="ANY" />
	</AttributeRule>
</AttributeFilterPolicy>

One more thing that I will add.  We have no difficulty release the email
attribute to SAML applications.

If anybody can point me to where I might have gone astray, I would
appreciate it.

Thanks,
Bryan

-- 
Bryan K. Walton						  319-337-3877 
Senior Linux Systems Administrator	    Leepfrog Technologies, Inc