Custom claims

[joestr]

Is there a possibility to create custom claims for users?

[eugenioenko]

HI @joestr, as of right now it's not possible to add custom claims. Currently there are few items on the roadmap so this could be prioritized.

The approach would be adding a JSON blob field on the user (editable via the admin API) whose contents get merged into the ID token, access token, and /userinfo endpoint. Would that cover your use case?

Also, I'm sorry for the late response, I usually look at issues only and didn't realize there was a new discussion

[joestr]

Alright! :)

The approach would be adding a JSON blob field on the user (editable via the admin API) whose contents get merged into the ID token, access token, and /userinfo endpoint. Would that cover your use case?

A blob field seems a bit unorganized for my taste. A Key/Value-Pair Layout would be a lot nicer to edit and maintain.

[eugenioenko]

Yeah, key/value pair is the way to go. Had a long day my head was clearly somewhere else XD

Had some time to put together custom claims v1.
#398

A few things that can be improved for sure but probably okey for v1:

• to get the custom claims client need to request custom_claims in scope and the same scope needs to be in the client allowed scopes. It works in the sense of that if client doesn't need custom claims, they are not added. Whats missing is the custom granularity of requesting a specific claim instead of all claims together.
• any string can be a custom claimae name (except the OIDC claims). Basically it avoids the extra claims_names table but it puts the responsability on the admin to use the right claime name. (so if there is a typo on the name, it's not surfaced on the idp level)
• finally, autentico will never override existing token claims with custom claims, thats a good solid security posture. No way to override for example the role or azp claim. Though in role case, being the admin, it can be changed via admin api. This looks solid but want to give it a look again later.

I'll leave the PR open a few days to test a few more things. Feel free to try it out if you get a chance :)