<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US>Hi,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>on a non-production IdP we're fiddling around with the authorization_code flow with PKCE, sometimes referenced as public client or SPA (Single Page Application). An external company is trying to implement OIDC Login against our IdP for their mobile apps.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Now they asked to include some claims in the access_token. Still not sure if I want to run this in production, but for testing purposes ok.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I set this config option in oidc.properties:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US># Special claim handling rules<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US># "Encoded" attributes are encrypted and embedded into the access token<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>idp.oidc.encodedAttributes = preferred_username<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>According to external company, AccessTokens they get, contain these:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>sub<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>aud<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>root_jti<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>auth_time<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>scope<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>iss<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>for_op<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>exp<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>iat<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>client_id<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>jti<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>sid<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>In IdP Debug Logs it also looks like preferred_username is not included (I removed most values):<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Profile Action BuildAccessToken: Claims stored to JWT access token: {"sub":"","iss":"","cnsnt":true,"prncpl":"","type":"at","nonce":"","sid":"","aud":"","root_jti":"","auth_time":,"scope":"openid profile offline_access","exp":,"iat":,"jti":""}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Reviewed documentation if further steps are necessary, nothing jumped me. Any ideas why preferred_username is not included in access_token?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal>Thank you, Björn<o:p></o:p></p></div></body></html>