[EXT] OIDC attribute/claim inclusion in id_token

[Paul B. Henson]

> From: Randy R. Rouch
> Subject: [EXT] OIDC attribute/claim inclusion in id_token
>
> we've run into an issue. They require that certain attributes like mail and sn be a
> part of the ID Token to log in instead of making a UserInfo Endpoint request.

We've done a bit more digging on this, and unless I misunderstand the OpenID Connect specification:

	https://openid.net/specs/openid-connect-core-1_0.html#Claims

specifically section 5.4:

"The Claims requested by the profile, email, address, and phone scope values are returned from the UserInfo Endpoint, as described in Section 5.3.2, when a response_type value is used that results in an Access Token being issued. However, when no Access Token is issued (which is the case for the response_type value id_token), the resulting Claims are returned in the ID Token."

given they are using the response type 'code', which does issue an access token the claims will not (and should not) be in the id_token, they must call the UserInfo endpoint to retrieve them.

Unless, as described in section 5.5, they included the "claims" request parameter, in particular the id_token section:

"id_token - Requests that the listed individual Claims be returned in the ID Token."

which they do not. At this point we plan to tell them our server is operating per the standard, and their client is broken. Are there any other details I might be missing which would put me in the wrong here :)?

It looks like most commercial vendors allow you to override the list of forced claims in the id_token on a per service basis rather than globally, which is why their client most likely works with their average customer. I suppose I would be willing to do that kludge, except currently as far as I can tell the idp only supports forcing extra claims into the id_token globally, not on a per relying party basis. Are there any plans to extend that functionality to account for the inability of the average commercial vendor to follow standards?

Thanks...