[EXT] OIDC attribute/claim inclusion in id_token

[Randy R. Rouch]

Thank you so much for your help, Scott!! We've tested it in Dev and it's working as we expected now.

Sincerely,
Randy



________________________________
From: users <users-bounces at shibboleth.net> on behalf of Paul B. Henson via users <users at shibboleth.net>
Sent: Wednesday, January 14, 2026 8:57 PM
To: Shib Users <users at shibboleth.net>
Cc: Paul B. Henson <henson at cpp.edu>
Subject: RE: [EXT] OIDC attribute/claim inclusion in id_token

CAUTION: External Email, see notice below



> From: Scott Cantor
> Sent: Wednesday, January 14, 2026 3:41 PM
>
> But I also said, and will repeat, that it's simpler to just do generic "all profiles"
> tagging as documented rather than bother with per-profile tagging.

I tried all kinds of combinations and just couldn't get it to work:

2026-01-14 20:22:27,523 - 10.104.223.9/node01wb0t45j9wcjz6fpf0mc35po417 - DEBUG [net.shibboleth.idp.attribute.config.AbstractMetadataDrivenConfigurationLookupStrategy:434] - No applicable mapped tag, applying default strategy for 'alwaysIncludedAttributes'

so I started poking around the source code to see where I was going wrong, and found an example in:

java-idp-oidc/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml

and it turns out I was putting the <mdattr:EntityAttributes> element in the wrong place 8-/. I had it in the SPSSODescriptor Extensions block as a peer to OAuthRPExtensions, when it was supposed to be in a top level Extensions block directly under EntityDescriptor <sigh>. Syntactically correct, so no errors, but semantically completely wrong.

So yay, now it finds it:

2026-01-14 20:34:35,011 - 10.104.223.9/node01i7b3upk4g14c2xsmnyjspu5r16 - DEBUG [net.shibboleth.idp.attribute.config.SetConfigurationLookupStrategy:51] - Converting tag 'http://shibboleth.net/ns/profiles/alwaysIncludedAttributes' to Set<String> property
2026-01-14 20:34:35,011 - 10.104.223.9/node01i7b3upk4g14c2xsmnyjspu5r16 - DEBUG [net.shibboleth.idp.attribute.config.AbstractMetadataDrivenConfigurationLookupStrategy:396] - Found matching mapped tag 'http://shibboleth.net/ns/profiles/alwaysIncludedAttributes' for property 'alwaysIncludedAttributes'

and I see the listed attributes in the id_token now when doing a code response request :).

As always, your expert guidance is much appreciated...

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
CAUTION: This email was NOT sent from an authorized Cal Poly Pomona service. Please review carefully before responding, clicking links, or opening attachments. Report phishing messages using the Outlook app<https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3> (mobile, web or desktop) or forward suspicious email to suspectemail at cpp.edu<mailto:suspectemail at cpp.edu>.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260115/e87c5ccc/attachment.htm>