[EXT] OIDC attribute/claim inclusion in id_token

[Randy R. Rouch]

We've been trying to set the alwaysIncludedAttributes setting on the entityID from the metadata side of things, but we're just not having any luck getting it to work. Here's a sample of the code we're using to try and integrate it:

<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
                   xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                   xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0"
                   xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
                   xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
 <EntityDescriptor entityID="oidc.example.org">
   <SPSSODescriptor protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
     <Extensions>
       ...
       <mdattr:EntityAttributes>
         <saml:Attribute Name="http://shibboleth.net/ns/profiles/oidc/sso/browser/alwaysIncludedAttributes"
                         NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
           <saml:AttributeValue>email</saml:AttributeValue>
           <saml:AttributeValue>name</saml:AttributeValue>
         </saml:Attribute>
       </mdattr:EntityAttributes>
     </Extensions>
     ...
   </SPSSODescriptor>
 </EntityDescriptor>
</EntitiesDescriptor>

I feel like there is some piece we're missing that will probably be painfully obvious once it's pointed out, but in the meantime might as well be lost in the fog.

Thanks,
Randy R. Rouch

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Scott Cantor <scott at restingparrotsoftware.com>
Sent: Wednesday, January 14, 2026 5:33 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: [EXT] OIDC attribute/claim inclusion in id_token

CAUTION: External Email, see notice below



Notably, I think I was incorrect and this is (also) a token profile setting, but the docs are the authority, not me. I confuse it all the time with the setting that embeds claims into the code so they're available on the back channel.

I think the setting is probably on both profiles since the ID token can be delivered either way.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
CAUTION: This email was NOT sent from an authorized Cal Poly Pomona service. Please review carefully before responding, clicking links, or opening attachments. Report phishing messages using the Outlook app<https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3> (mobile, web or desktop) or forward suspicious email to suspectemail at cpp.edu<mailto:suspectemail at cpp.edu>.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260114/3908a45b/attachment.htm>