Add email claim to Access Token oauth2

[Pedro Miguel Marques]

Hi Henri,

Thanks for your reply.
Yes i'm running the oidc sequence

>From what I was able to verify, using the resource parameter or the
audience parameter in resource json metadata does not change the way the
claim aud is filled in the jwt access token. The claim aud in jwt
accessToken is always filled with the issuer OIDC OP  url, what i'm doing
wrong here?

>From what I understand, is it not possible to add the email value in the
accessToken ? It is only available when accessing the userinfo endpoint .


Thanks for your help

Best regards.


Henri Mikkonen <henri.mikkonen at nimbleidm.com> escreveu (quarta, 24/09/2025
à(s) 07:43):

> Hi Pedro,
>
> As you mention id_token, you seem to be running the OIDC sequence. If
> that's the case, the access token issued by OP is solely meant for
> accessing OP's own user info endpoint so it's useless to include claims
> like email to the access token. See audience/aud -claim: nobody else
> except OP itself should be exploiting the access token.
>
> If you want to include some other resources to the audience, the RP may
> request it by exploiting the resource parameter as defined here:
>
> https://www.rfc-editor.org/rfc/rfc8707.html
>
> The resource needs to be (1) registered to OP via OIDC/SAML metadata and
> (2) linked to your RP via "audience", see [1].
>
> Whenever there are other audiences than OP itself, the claims will be
> included in the JWT access token.
>
> We have a backlog ticket to improving this feature (i.e. make the
> configuration less complicated) [2], but it hasn't been scheduled yet.
>
> BR,
> Henri.
>
> [1]
>
> https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile
>
> [2] https://shibboleth.atlassian.net/browse/JOIDC-247
>
> On 23.9.2025 16.45, Pedro Miguel Marques via users wrote:
> > Hi,
> >
> > Im' trying to figure out how get email claim on access token oauth2, the
> > attribute is being resolved and filtered, but does not figure in
> > AccessToken, only in idToken.
> > The shibboleth version is 5.1.4, the version of OIDC OP plugin is 4.30.
> >
> >
> > Anyone could help with this?
> >
> > Thanks in advance
> >
> > Pedro
> >
> >
> >
> >
> >
> >
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250924/5d60a6cf/attachment.htm>