[EXT] OIDC attribute/claim inclusion in id_token

[Paul B. Henson]

> From: Scott Cantor <scott at restingparrotsoftware.com>
> Sent: Tuesday, January 13, 2026 5:11 PM
> 
> There are few "global" settings. The shortcut properties just auto-populate a
> profile setting globally, they're all still per-profile bean, overrideable with
> metadata tags, etc., including the one that forces claims into the ID token.

Ah, interesting; I didn't realize that. I don't recall seeing that in the documentation, at least explicitly.

Looking again, I did find the more generic alwaysIncludedAttributes property documented in the OIDC Profile-Specific section of the OPToken profile configuration bean:

https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken

Are there any examples anywhere of setting it on a per relying party basis, or is that left as a lesson for the reader :)?

We do use metadata driven configuration on our SAML metadata, and also use the OIDC.*.MDDriven beans in our relying-party.xml configuration. I don't see them listed on the metadata driven configuration page?

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631679/MetadataDrivenConfiguration

Extrapolating, my best guess would be something like this? Close :)?

<MetadataFilter xsi:type="EntityAttributes">
		<saml:Attribute Name="http://shibboleth.net/ns/profiles/oauth2/token/ alwaysIncludedAttributes"
			NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
			<saml:AttributeValue>email,name</saml:AttributeValue>
		</saml:Attribute>
		<Entity>https://oidc.example.org/rp</Entity>
	</MetadataFilter>

Out of curiosity, am I correct in my interpretation of the specification that if they want these attributes in the id_token they should be asking for them explicitly rather than requiring us to do a kludge like this?

Thanks much...