<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you so much for your help, Scott!! We've tested it in Dev and it's working as we expected now.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Sincerely,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Randy</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Paul B. Henson via users <users@shibboleth.net><br>
<b>Sent:</b> Wednesday, January 14, 2026 8:57 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Paul B. Henson <henson@cpp.edu><br>
<b>Subject:</b> RE: [EXT] OIDC attribute/claim inclusion in id_token</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: External Email, see notice below<br>
<br>
<br>
<br>
> From: Scott Cantor<br>
> Sent: Wednesday, January 14, 2026 3:41 PM<br>
><br>
> But I also said, and will repeat, that it's simpler to just do generic "all profiles"<br>
> tagging as documented rather than bother with per-profile tagging.<br>
<br>
I tried all kinds of combinations and just couldn't get it to work:<br>
<br>
2026-01-14 20:22:27,523 - 10.104.223.9/node01wb0t45j9wcjz6fpf0mc35po417 - DEBUG [net.shibboleth.idp.attribute.config.AbstractMetadataDrivenConfigurationLookupStrategy:434] - No applicable mapped tag, applying default strategy for 'alwaysIncludedAttributes'<br>
<br>
so I started poking around the source code to see where I was going wrong, and found an example in:<br>
<br>
java-idp-oidc/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml<br>
<br>
and it turns out I was putting the <mdattr:EntityAttributes> element in the wrong place 8-/. I had it in the SPSSODescriptor Extensions block as a peer to OAuthRPExtensions, when it was supposed to be in a top level Extensions block directly under EntityDescriptor
<sigh>. Syntactically correct, so no errors, but semantically completely wrong.<br>
<br>
So yay, now it finds it:<br>
<br>
2026-01-14 20:34:35,011 - 10.104.223.9/node01i7b3upk4g14c2xsmnyjspu5r16 - DEBUG [net.shibboleth.idp.attribute.config.SetConfigurationLookupStrategy:51] - Converting tag '<a href="http://shibboleth.net/ns/profiles/alwaysIncludedAttributes">http://shibboleth.net/ns/profiles/alwaysIncludedAttributes</a>'
to Set<String> property<br>
2026-01-14 20:34:35,011 - 10.104.223.9/node01i7b3upk4g14c2xsmnyjspu5r16 - DEBUG [net.shibboleth.idp.attribute.config.AbstractMetadataDrivenConfigurationLookupStrategy:396] - Found matching mapped tag '<a href="http://shibboleth.net/ns/profiles/alwaysIncludedAttributes">http://shibboleth.net/ns/profiles/alwaysIncludedAttributes</a>'
for property 'alwaysIncludedAttributes'<br>
<br>
and I see the listed attributes in the id_token now when doing a code response request :).<br>
<br>
As always, your expert guidance is much appreciated...<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
CAUTION: This email was NOT sent from an authorized Cal Poly Pomona service. Please review carefully before responding, clicking links, or opening attachments. Report phishing messages using the Outlook app<<a href="https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3">https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3</a>>
(mobile, web or desktop) or forward suspicious email to suspectemail@cpp.edu<mailto:suspectemail@cpp.edu>.<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>