Livio, I would suggest not overriding predefined scopes (openid, profile, email). If you map your ldap attribute names to the oidc standards, they will be picked up by those scopes. For example: cas.authn.oidc.core.claims-map.family_name=sn See [1] for spec. If you need to have lastname as a claim, make a user defined scope with those claims: cas.authn.oidc.core.user-defined-scopes.names=lastname,firstname,displayname To get other claims in the payload, like names or MemberOf, include that scope in the 'scopes' HashSet of your service definition.
Ray [1] https://openid.net/specs/openid-connect-core-1_0.html ________________________________ From: [email protected] <[email protected]> on behalf of livio dezorzi <[email protected]> Sent: May 27, 2026 07:46 To: CAS Community <[email protected]> Subject: [cas-user] Re: attributes released vs id_token I found a lead. I used the blog post https://fawnoos.com/2022/08/18/cas66-openid-connect-scopes/ to customize my OpenLDAP attributes as follows in the cas.properties file : cas.authn.oidc.core.claims-map.email=mailRoutingAddress cas.authn.oidc.core.claims-map.MemberOf=crnpdcattgroupe cas.authn.oidc.core.claims-map.firstname=givenName cas.authn.oidc.core.claims-map.lastname=sn cas.authn.oidc.core.claims-map.displayname=displayName cas.authn.oidc.core.claims-map.compteactif=crnpdcattcompteactif cas.authn.oidc.core.claims-map.fonction=crnpdcattfonctionlibelle cas.authn.oidc.core.claims-map.secteur=crnpdcattsecteurlibelle cas.authn.oidc.core.claims-map.service=crnpdcattservicelibelle as.authn.oidc.core.claims-map.departement=crnpdcattdepartementlibelle cas.authn.oidc.core.claims-map.direction=crnpdcattdirectionlibelle cas.authn.oidc.core.claims-map.contrat=employeeType cas.authn.oidc.core.user-defined-scopes.organisation=fonction,service,departement,direction cas.authn.oidc.core.user-defined-scopes.openid=sub cas.authn.oidc.core.user-defined-scopes.profile=uid,firstname,lastname,displayname,compteactif,contrat cas.authn.oidc.core.user-defined-scopes.MemberOf=MemberOf cas.authn.oidc.core.user-defined-scopes.ismemberof=MemberOf cas.authn.oidc.core.user-defined-scopes.memberofargos=MemberOf cas.authn.oidc.core.user-defined-scopes.memberofedgar=MemberOf cas.authn.oidc.core.user-defined-scopes.memberofsigport=MemberOf cas.authn.oidc.discovery.claims=sub,uid,email,firstname,lastname,displayname,compteactif,fonction,secteur,service,departement,direction,contrat,MemberOf,ismemberof,memberofargos,memberofedgar,memberofsigport cas.authn.oidc.discovery.scopes=sub,openid,profile,email,organisation,MemberOf,memberofargos,memberofedgar,memberofsigport,ismemberof and my json service : { "@class": "org.apereo.cas.services.OidcRegisteredService", "serviceId": "https://....../iam/realms/SP/broker/oidc-hdf/endpoint";, "name": "SP-v09", "id": 329738878, "description": "OpenID Connect service SP-v09", "attributeReleasePolicy": { "@class": "org.apereo.cas.services.ChainingAttributeReleasePolicy", "policies": [ "java.util.ArrayList", [ { "@class": "org.apereo.cas.oidc.claims.OidcProfileScopeAttributeReleasePolicy" }, { "@class": "org.apereo.cas.oidc.claims.OidcEmailScopeAttributeReleasePolicy" } ] ], "mergingPolicy": "REPLACE", "principalAttributesRepository": { "@class": "org.apereo.cas.authentication.principal.ChainingPrincipalAttributesRepository" }, "consentPolicy": { "@class": "org.apereo.cas.services.consent.ChainingRegisteredServiceConsentPolicy" }, "authorizedToReleaseAuthenticationAttributes": true }, "clientSecret": "xxxxxxxxxxx", "clientId": "xxxxxxxxxxxxxxxxx", "bypassApprovalPrompt": true, "jwtAccessToken": true, "supportedGrantTypes": [ "java.util.HashSet", [ "refresh_token", "client_credentials", "authorization_code" ] ], "supportedResponseTypes": [ "java.util.HashSet", [ "code", "id_token" ] ], "scopes": [ "java.util.HashSet", [ "openid", "profile", "email" ] ] } It seems the attributes are being lost because if I don't customize the OpenLDAP attributes, I find them correctly in the id_toekn. "attributeReleasePolicy": { "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy", "allowedAttributes": [ "java.util.ArrayList", [ "uid", "givenName", "mailRoutingAddress", "sn", "crnpdcattgroupe" ] ] }, How to use attributes friendly name in json service and configured in cas.properties file ? Thanks Le mercredi 27 mai 2026 à 15:43:58 UTC+2, livio dezorzi a écrit : Hello, I'm having a problem with CAS v7.3.6 and a Service Provider using Keycloak and OpenID Connect. I need to publish the attributes in `id_token`. In my JSON service, I declared `supportedResponseTypes` with `code` and `id_token`. But when I log into the application, after decoding the `id_token`, I can't find the attributes like firtname, lastname, email... However, with a php/apache2 test application and libapache2-mod-auth-openidc which retrieves the attributes in the header, I have all my attributes published. The JSON services are identical except for the client and secret ID. Where did I go wrong ? Just so you know, my .well-known/openid-configuration file clearly specifies the supported response types: code, id_token, id_token token, and device_code Thanks for your leads -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/48758c01-21b6-4584-b94f-b8403cc92368n%40apereo.org<https://groups.google.com/a/apereo.org/d/msgid/cas-user/48758c01-21b6-4584-b94f-b8403cc92368n%40apereo.org?utm_medium=email&utm_source=footer>. -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB008186FEAE873D166212641FCE082%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM.
