# Unable to add 'idp' claim to access token for user

**URL:** <https://devforum.okta.com/t/unable-to-add-idp-claim-to-access-token-for-user/22091>\
**Category:** OAuth/OIDC\
**Created:** [October 7, 2022, 6:10pm UTC](https://devforum.okta.com/t/unable-to-add-idp-claim-to-access-token-for-user/22091 "2022-10-07T18:10:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![esitzes](https://avatars.discourse-cdn.com/v4/letter/e/c89c15/32.png) [@esitzes](https://devforum.okta.com/u/esitzes)\
**Post date:** [October 7, 2022, 6:10pm UTC](https://devforum.okta.com/t/unable-to-add-idp-claim-to-access-token-for-user/22091/1 "2022-10-07T18:10:33Z")

</div>

I see the `idp` claim for a user is included on their `id_token` by default. However I am unable to figure out how to add the same `idp` claim to a user `access_token`. I have tried several custom claims (`idp`, `idp.id`, `user.idp.id`, `idpuser.idp.id`, etc.) but none of them work. Does anyone know what expression I can use to match a user’s IDP id?

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [October 7, 2022, 11:40pm UTC](https://devforum.okta.com/t/unable-to-add-idp-claim-to-access-token-for-user/22091/2 "2022-10-07T23:40:03Z")

</div>

Hello,

- You could use a [inline token hook](https://developer.okta.com/docs/reference/token-hook/) where your service gets the idp value from the id\_token sent and then adds it to the access\_token as well.
- In your IdP settings in Okta you could create a specific group for each IdP you have and assign users that authenticate with that IdP to that group. You could then create a custom claim in your authorization server where you check for group membership and if a member add the corresponding IdP id.

---

<div class="post-metadata">

**Author:** ![esitzes](https://avatars.discourse-cdn.com/v4/letter/e/c89c15/32.png) [@esitzes](https://devforum.okta.com/u/esitzes)\
**Post date:** [October 10, 2022, 6:06pm UTC](https://devforum.okta.com/t/unable-to-add-idp-claim-to-access-token-for-user/22091/3 "2022-10-10T18:06:36Z")

</div>

Thanks @erik, I think I will go with one of these solutions. I was hoping there was something straightforward built into Okta, but I think this is probably an okay workaround. We are going to be looking at inline hooks anyways, so I will experiment with adding a command in there to grab the `idp` value from the `id_token` and add it to the `access_token`

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 12, 2024, 10:12pm UTC](https://devforum.okta.com/t/unable-to-add-idp-claim-to-access-token-for-user/22091/4 "2024-02-12T22:12:14Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.