FAQ: How Do OIDC Scopes Relate to Claims?

Version Affected: All

 

Overview

How do OpenID Connect (OIDC) scopes relate to claims?
 

Answer

There is a direct relationship between scopes and claims, following the OpenID Connect Basic Client specification. Each scope grants access to a corresponding set of claims:

• openid — required.
• profile — optional. Gives the name, family_name, given_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, and updated_at claims.
• email — optional. Gives the email and email_verified claims.
• address — optional. Gives the address claim.
• phone — optional. Gives the phone_number and phone_number_verified claims.

On the Post Authentication tab, be sure to map each required claim to a profile field — otherwise the claim is still not included in the ID token even if the corresponding scope is requested.
 

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.