3

I have installed WSO2 IS 5.2.0 and I have problem to retrieve custom created claims.

I've added new claims to dialect http://wso2.org/claims and I also added new claims that map the same attribute to dialect http://wso2.org/oidc/claim that worked with version 5.1.0 but in version 5.2.0 not working.

All fields are present in database attribute table. I am using Oauth2 OpenID connect userInfo for fetching user data.

Here is claims configuration for my Service Provider: enter image description here

With this configuration in 5.1.0 I got all requested claims from image, but in 5.2.0 I get only claims that are not custom - that was already present in both dialects by default.

Community
  • 1
  • 1
zarej
  • 913
  • 1
  • 11
  • 23

2 Answers2

6

The reason for this behaviour is the introduction of OpenIDConnect claim scopes in 5.2.0. So basically when you are requesting for a OIDC token you can specify a scope value that is bound to a set of claims. So when you send that OIDC token to the userinfo endpoint only those claims which are common in both OIDC scope config and SP claim configuration (ie. intersection of claim in both these configs) will be returned.

Let's take an example, consider the default required scope need to get an OIDC token which is 'openid'

openid scope is bound to the following schemes.

sub, email, email_verified, name, family_name,given_name,middle_name,nickname,preferred_username,profile,picture,website,gender,birthdate,zoneinfo,locale,updated_at,phone_number,phone_number_verified,address,street

(you can configure this using 'oidc' file found in the registry at /_system/config/oidc)

enter image description here

So in your case please add the custom claims slotCentreURL,role, slotCentre into the mapped claims for this scope by editing the oidc file.

enter image description here

Alternatively you can add a new scope say 'customSPScope1' with claims that you need, send it when getting the OIDC token in addition to the mandatory openid scope.

You also need to configure the required claims at Service Provider configuration. The logic here is that only the intersection of claims configured at OIDC scope level and claims configured at SP level are returned.

farasath
  • 2,961
  • 2
  • 15
  • 16
  • Thanks that works. Is this means that claim configuration for Service Provider is not matter anymore? – zarej Oct 16 '16 at 00:53
  • Actually the final output is the intersection of OIDC scope claims and claims configured at the SP. So still the claims configured at the SP matters :) – farasath Oct 18 '16 at 05:19
  • I am also trying to add custom claim, but not working. I have added mobile_verified attribute to both dialect. Then edited openid scope and added mobile_verified to it but not getting it in userinfo response. How did you mapped new scope? Just edited openid or created new scope? Any change in physical file? – Amreesh Tyagi Nov 06 '16 at 23:13
  • what is the mapped attribute you used when adding the claim to both dialects? – farasath Nov 07 '16 at 17:04
-1

The reason could be the mapped attribute. You need to configure same maapped attribute in both OIDC dialect and wso2 dialect for custom claims

  • That is not the case, I have the same mapped attributes in both dialects. The same configuration works on 5.1.0 but on 5.2.0 not. – zarej Oct 13 '16 at 17:36