[EXT] OIDC attribute/claim inclusion in id_token

[Paul B. Henson]

On Tue, Jan 13, 2026 at 10:09:19PM -0500, Scott Cantor wrote:

> The properties ought to say something or other to that effect if they
> don't, probably should just say "globally" control XXX profile
> setting.

Currently looks like:

----
# Special claim handling rules
[...]
# "Always included" attributes are forced into ID tokens for all
# response_types
#idp.oidc.alwaysIncludedAttributes =
----

> Multiple values for a list setting are multiple value elements, not
> delimited.

Ah, I was basing it on the property, which gets dumped as a literal
string in the bean config:

	p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"

but I see that's converted to an array elsewhere:

      <bean parent="shibboleth.CommaDelimStringArray">
         <constructor-arg type="java.lang.String"
            value="%{idp.oidc.alwaysIncludedAttributes:}" />
     </bean>

> This setting should be on the authorization endpoint profile, anyway,
> so it wouldn't be that one.

Got it; looks like that property is on both the OPToken page and the
OPAuthorization page, I must've missed it on the latter on my first
review. So given that and the previous correction, I'm left with:

<saml:Attribute
  Name="http://shibboleth.net/ns/profiles/oidc/sso/browser/alwaysIncludedAttributes" 
  NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
 <saml:AttributeValue>email</saml:AttributeValue>   
 <saml:AttributeValue>name</saml:AttributeValue>   
</saml:Attribute>                                               

Thanks again for the help.

-- 
Paul B. Henson | Operating Systems and Network Analyst
henson at cpp.edu | California State Polytechnic University Pomona