<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
We've been trying to set the alwaysIncludedAttributes setting on the entityID from the metadata side of things, but we're just not having any luck getting it to work. Here's a sample of the code we're using to try and integrate it:</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<b><br>
</b></div>
<div style="font-family: "Aptos Mono", Aptos_EmbeddedFont, Aptos_MSFontService, monospace; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<b><EntitiesDescriptor </b>xmlns="urn:oasis:names:tc:SAML:2.0:metadata" <br>
<b> </b>xmlns:ds="http://www.w3.org/2000/09/xmldsig#" <br>
<b> </b>xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0" <br>
<b> </b>xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
<br>
<b> </b>xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<b>></b></div>
<div style="font-family: "Aptos Mono", Aptos_EmbeddedFont, Aptos_MSFontService, monospace; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<b><EntityDescriptor </b>entityID="oidc.example.org"<b>></b> <br>
<b><SPSSODescriptor </b>protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html"<b>></b>
<br>
<b><Extensions></b></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);" class="elementToProof">
<span style="font-family: "Aptos Mono", Aptos_EmbeddedFont, Aptos_MSFontService, monospace; font-size: 11pt;"><b> ...<br>
</b> <b><</b>mdattr:<b>EntityAttributes></b> <br>
<b><</b>saml:<b>Attribute </b>Name="http://shibboleth.net/ns/profiles/oidc/sso/browser/alwaysIncludedAttributes"
<br>
<b> </b>NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<b>></b>
<br>
<b><</b>saml:<b>AttributeValue></b>email<b></</b>saml:<b>AttributeValue></b>
<br>
<b><</b>saml:<b>AttributeValue></b>name<b></</b>saml:<b>AttributeValue></b>
<br>
<b></</b>saml:<b>Attribute></b> <br>
<b></</b>mdattr:<b>EntityAttributes></b> <br>
<b></Extensions></b> <br>
...<br>
<b></SPSSODescriptor></b> <br>
<b></EntityDescriptor></b><br>
<b></EntitiesDescriptor></b></span><span style="font-size: 12pt;"><br>
<br>
</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I feel like there is some piece we're missing that will probably be painfully obvious once it's pointed out, but in the meantime might as well be lost in the fog.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thanks,</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Randy R. Rouch</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Scott Cantor <scott@restingparrotsoftware.com><br>
<b>Sent:</b> Wednesday, January 14, 2026 5:33 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: [EXT] OIDC attribute/claim inclusion in id_token</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: External Email, see notice below<br>
<br>
<br>
<br>
Notably, I think I was incorrect and this is (also) a token profile setting, but the docs are the authority, not me. I confuse it all the time with the setting that embeds claims into the code so they're available on the back channel.<br>
<br>
I think the setting is probably on both profiles since the ID token can be delivered either way.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
CAUTION: This email was NOT sent from an authorized Cal Poly Pomona service. Please review carefully before responding, clicking links, or opening attachments. Report phishing messages using the Outlook app<<a href="https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3">https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3</a>>
(mobile, web or desktop) or forward suspicious email to suspectemail@cpp.edu<mailto:suspectemail@cpp.edu>.<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>