Add email claim to Access Token oauth2

[Henri Mikkonen]

Hi Pedro,

On 24.9.2025 15.02, Pedro Miguel Marques via users wrote:
>  From what I was able to verify, using the resource parameter or the 
> audience parameter in resource json metadata does not change the way the 
> claim aud is filled in the jwt access token. The claim aud in jwt 
> accessToken is always filled with the issuer OIDC OP  url, what i'm 
> doing wrong here?

Are you using the resource-parameter in the authentication request? The 
RFC says that RP needs to request the additional resources with that 
parameter. The audience needs to be in the JSON metadata. The value is 
the same in both requested resource and metadata audience. Also remember 
to add that as trusted entry in the metadata, i.e. make a record that 
has client_id with the value.

I forgot to mention in my previous email that you need to also enable 
OAUTH2.TokenAudience in the relying-party.xml, for instance in the 
following way for shibboleth.DefaultRelyingParty:

<bean parent="OAUTH2.TokenAudience" p:accessTokenType="JWT" 
p:encryptionOptional="true"/>

>  From what I understand, is it not possible to add the email value in 
> the accessToken ? It is only available when accessing the userinfo 
> endpoint .

UserInfo is the OIDC-way to fetch the claims. By using the resource 
indicator, you may add additional trusted resources as audience to the 
JWT access token. That makes the access token to be exploitable by those 
resources and they will contain the claims too.

In the default case, why would you want to add email in the access 
token? As by default the JWT access token is solely targeted to OP 
itself (via audience), nobody else shouldn't be exploiting its contents.

BR,
Henri.