Add email claim to Access Token oauth2

[Pedro Miguel Marques]

> Hi  Henri,


Thanks for the reply.

>
>
> Are you using the resource-parameter in the authentication request? The
> RFC says that RP needs to request the additional resources with that
> parameter. The audience needs to be in the JSON metadata. The value is
> the same in both requested resource and metadata audience. Also remember
> to add that as trusted entry in the metadata, i.e. make a record that
> has client_id with the value.
>
> I forgot to mention in my previous email that you need to also enable
> OAUTH2.TokenAudience in the relying-party.xml, for instance in the
> following way for shibboleth.DefaultRelyingParty:
>
> <bean parent="OAUTH2.TokenAudience" p:accessTokenType="JWT"
> p:encryptionOptional="true"/>
>
> My bad. the parameter was missing in the authentication request

>
> UserInfo is the OIDC-way to fetch the claims. By using the resource
> indicator, you may add additional trusted resources as audience to the
> JWT access token. That makes the access token to be exploitable by those
> resources and they will contain the claims too.
>
> It is working, like you mentioned. Thanks


> In the default case, why would you want to add email in the access
> token? As by default the JWT access token is solely targeted to OP
> itself (via audience), nobody else shouldn't be exploiting its contents.
>
> Because the application from a third party, that we are integrating with
our OIDC OP, needs to get the email claim from the acessToken. Does it make
sense? It should be like this?

Thank you very much for all your support
Best regards.





> BR,
> Henri.
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250924/b5fbe81f/attachment.htm>