How To: Include the User's Password in the OIDC id_token JWT Payload

Version Affected: 9.0+

 

Overview

This article explains how to configure a SecureAuth Identity Provider (IdP) realm so that its OpenID Connect (OIDC) id_token JSON Web Token (JWT) payload includes the authenticated user's password as a custom claim. Sending a user's password inside a bearer token is not recommended; only configure this when an OIDC client requires the user's password for legacy delegation purposes.

Include the User's Password in the id_token

1. Open the realm's Identity/Authentication Consumers page and select the Custom Identity Consumer. Set Token Data Type (Send) to Password, then save the change.

2. Go to Post Authentication > OpenID Connect/OAuth 2.0 - Custom Claims and click Add Custom Claim.
3. Create a claim — for example, one named usrpwd — and leave its Profile Property set to - Unmapped -.

4. Open the realm's web.config and add profileProperty="31" to the custom claim's element. 31 is the profile property value that represents the user's password, and it is never displayed in the Admin Console UI.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.