Okta : how to add custom attributes of User profile as claim in token

Questions OAuth/OIDC
1

Hi Team,

We are unable to get custom attribute of user profile as claims in token.

Below is the screenshot of added custom attribute in default authorization server. We also tried with custom authorization server but still unable to get custom attribute as claim in token.

setup
setup436×327 23 KB

This is high priority item for us.
Please help us to resolve this issue as early as possible.

Let me know if you need more information.

2

Can you confirm a couple of things:

  1. From which Authorization Server are you requesting tokens? As you mentioned adding this in your Default Authorization Server, can you make sure you are making request to the same default Authorization Server? For example, if you are completing Authorization Code flow, you would be making calls to /oauth2/default/v1/authorize and /oauth2/default/v1/token. Does that match your tests?
  2. When you request tokens, which scopes are you requesting?
  3. For your test user, do they have a value for tenant_id as set in their Okta User Profile or is it null?
  4. When you use the Token Preview tool to test your claim, do you see it returned within the payload of an ID Token?
3
  1. Yes, we are making request to the same default authorization server.
  2. Scopes - email, profile, openid
  3. I didnt understand this question.
  4. Yes, we have tenant_id is returned in ID token. Now, we edited the claim and changed token type to access token and tenant_id is returned in access token as well.
    Thank you for your help.
4

We have noticed in logs -
After investigation, we suspect that the oauth2ClaimSystem value is set to false, preventing proper evaluation and inclusion of custom claims in the access token.
Is our understanding correct?

5

That’s not sounding all that familiar.

I want to double check your answer for #3. Your claim expression says that it should populate the tenantid claim based on the value of a custom tenant_id attribute in the Okta User Profile. Can you share a screenshot of how and where you configured that custom attribute?

If Token Preview is working for you and the tenantid claim is showing up there, then I would still guess that when you actually request tokens, you are doing something different, either by requesting different scopes or from using a different authorization server. Maybe you can share an anonymized copy of the token payload for an impacted user (censoring any sensitive values) to help confirm that?

6

Issue is resolved. Thanks for giving pointer of payload values. We noticed payload value was incorrect. Appreciate your help.

1 Like
7

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.