How To: Include the User's Password in the OIDC id_token JWT Payload – SecureAuth Support

Version Affected: 9.0+

Overview

This article explains how to configure a SecureAuth Identity Provider (IdP) realm so that its OpenID Connect (OIDC) id_token JSON Web Token (JWT) payload includes the authenticated user's password as a custom claim. Sending a user's password inside a bearer token is not recommended; only configure this when an OIDC client requires the user's password for legacy delegation purposes.

Include the User's Password in the id_token

Open the realm's Identity/Authentication Consumers page and select the Custom Identity Consumer. Set Token Data Type (Send) to Password, then save the change.

Custom Identity Consumer panel with Token Data Type (Send) set to Password.

Go to Post Authentication > OpenID Connect/OAuth 2.0 - Custom Claims and click Add Custom Claim.
Create a claim — for example, one named usrpwd — and leave its Profile Property set to - Unmapped -.

OpenID Connect/OAuth 2.0 Custom Claims panel with a custom claim named usrpwd and Profile Property set to - Unmapped -.

Open the realm's web.config and add profileProperty="31" to the custom claim's element. 31 is the profile property value that represents the user's password, and it is never displayed in the Admin Console UI.

Web.config claim element reading claim name=usrpwd profileProperty=31 isCustom=true.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.