Add email claim to Access Token oauth2

[Henri Mikkonen]

Hi Pedro,

As you mention id_token, you seem to be running the OIDC sequence. If 
that's the case, the access token issued by OP is solely meant for 
accessing OP's own user info endpoint so it's useless to include claims 
like email to the access token. See audience/aud -claim: nobody else 
except OP itself should be exploiting the access token.

If you want to include some other resources to the audience, the RP may 
request it by exploiting the resource parameter as defined here:

https://www.rfc-editor.org/rfc/rfc8707.html

The resource needs to be (1) registered to OP via OIDC/SAML metadata and 
(2) linked to your RP via "audience", see [1].

Whenever there are other audiences than OP itself, the claims will be 
included in the JWT access token.

We have a backlog ticket to improving this feature (i.e. make the 
configuration less complicated) [2], but it hasn't been scheduled yet.

BR,
Henri.

[1] 
https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile

[2] https://shibboleth.atlassian.net/browse/JOIDC-247

On 23.9.2025 16.45, Pedro Miguel Marques via users wrote:
> Hi,
> 
> Im' trying to figure out how get email claim on access token oauth2, the 
> attribute is being resolved and filtered, but does not figure in 
> AccessToken, only in idToken.
> The shibboleth version is 5.1.4, the version of OIDC OP plugin is 4.30.
> 
> 
> Anyone could help with this?
> 
> Thanks in advance
> 
> Pedro
> 
> 
> 
> 
> 
>