Does tinyauth support additionalClaims with oidc?

[SpiderUnderUrBed]

Does tinyauth support additionalClaims with oidc so i can add stuff like userperms for this project i am working on, user perms being a custom field which i set per user?

[dosubot[bot]]

Tinyauth does not support arbitrary custom claims in OIDC tokens. The maintainer has explicitly decided against this in favor of strict OpenID Connect specification compliance [1]. This means you can't add custom claim names like userperms to ID tokens.

That said, here are a few things Tinyauth does support that might help depending on your setup:

• Groups scope — If your permissions can be modeled as group memberships, requesting the groups scope will include group info in the token [2]. Groups from LDAP or OAuth providers are automatically passed through.
• Standard claim values per user — You can customize the values of standard OIDC claims (like name, email, etc.) on a per-user basis via auth.userAttributes in config [3], but you can't add new claim names.
• HTTP headers (proxy mode) — If you're using Tinyauth as a forward-auth proxy, it sets headers like Remote-User, Remote-Groups, etc. on requests to your app [4]. You can also configure custom response headers per app via app.response.headers [5].

For a custom userperms field, you'd likely need to handle that in your own application layer — e.g., look up the authenticated user (from the sub claim or Remote-User header) and resolve their permissions on your side.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[steveiliop56]

The bot answer is wrong.

We haven't said no to custom claims when Tinyauth is the OpenID Connect Provider but we don't support them right now. Please open a feature request so we can have a look at it in the future.

[dosubot[bot]]

Thanks for the correction! To clarify: Tinyauth doesn't currently support custom claims when acting as an OIDC provider, but it hasn't been ruled out — it's something that could be considered in the future via a feature request.

If you'd like, you can say @dosu save this or @dosu update the docs to reflect this so I don't get this wrong again.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[SpiderUnderUrBed]

Does this cover it?
#830

@steveiliop56

[SpiderUnderUrBed]

Opened #838