[EXT] OIDC attribute/claim inclusion in id_token

[Paul B. Henson]

> From: Scott Cantor
> Sent: Wednesday, January 14, 2026 3:41 PM
> 
> But I also said, and will repeat, that it's simpler to just do generic "all profiles"
> tagging as documented rather than bother with per-profile tagging.

I tried all kinds of combinations and just couldn't get it to work:

2026-01-14 20:22:27,523 - 10.104.223.9/node01wb0t45j9wcjz6fpf0mc35po417 - DEBUG [net.shibboleth.idp.attribute.config.AbstractMetadataDrivenConfigurationLookupStrategy:434] - No applicable mapped tag, applying default strategy for 'alwaysIncludedAttributes'

so I started poking around the source code to see where I was going wrong, and found an example in:

java-idp-oidc/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml

and it turns out I was putting the <mdattr:EntityAttributes> element in the wrong place 8-/. I had it in the SPSSODescriptor Extensions block as a peer to OAuthRPExtensions, when it was supposed to be in a top level Extensions block directly under EntityDescriptor <sigh>. Syntactically correct, so no errors, but semantically completely wrong.

So yay, now it finds it:

2026-01-14 20:34:35,011 - 10.104.223.9/node01i7b3upk4g14c2xsmnyjspu5r16 - DEBUG [net.shibboleth.idp.attribute.config.SetConfigurationLookupStrategy:51] - Converting tag 'http://shibboleth.net/ns/profiles/alwaysIncludedAttributes' to Set<String> property
2026-01-14 20:34:35,011 - 10.104.223.9/node01i7b3upk4g14c2xsmnyjspu5r16 - DEBUG [net.shibboleth.idp.attribute.config.AbstractMetadataDrivenConfigurationLookupStrategy:396] - Found matching mapped tag 'http://shibboleth.net/ns/profiles/alwaysIncludedAttributes' for property 'alwaysIncludedAttributes'                             

and I see the listed attributes in the id_token now when doing a code response request :).

As always, your expert guidance is much appreciated...