<div dir="ltr">Mark - <div><br></div><div>  You can work with the JWT Token inside of shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy (which would be configured in authn/duo-oidc-authn-config.xml).</div><div><br></div><div>  You can see some details and an example under "Context to Principal Mapping Strategy" within the "Advanced Topics"  on <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1374027959/DuoOIDCAuthnConfiguration#Advanced-Topics">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1374027959/DuoOIDCAuthnConfiguration#Advanced-Topics</a></div><div><br></div><div>Steve.</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, Feb 24, 2026 at 3:18 PM Mark Boyce via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-7785868438439083143">





<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_-7785868438439083143WordSection1">
<p class="MsoNormal">Hello All,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have an ask to capture the payload from Duo’s JWT Token post authentication and include some elements as attributes passed in the SAML Assertion. My understanding is that the token is discarded after the authentication flow is completed.
 Has anyone had any success with capturing this?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal">m.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><span style="font-family:Arial,sans-serif;color:rgb(0,112,192)">Mark L. Boyce</span></b><span style="font-family:"Times New Roman",serif"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(127,127,127)">Senior Identity Management Analyst<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(127,127,127)">University of California, Office of the President<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(127,127,127)">Office: 510.987.9681<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(127,127,127)">Cell: 209.851.0196</span><span style="font-family:"Times New Roman",serif"><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>

-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>