features.claimsParameter

OIDC Core 1.0 - Requesting Claims using the “claims” Request Parameter

Specifies whether the claims request parameter shall be enabled for authorization requests. When enabled, the authorization server shall accept and process the claims parameter to enable fine-grained control over which claims are returned in ID Tokens and from the UserInfo Endpoint.

default value:

{
  assertClaimsParameter: [AsyncFunction: assertClaimsParameter], // see expanded details below
  enabled: false
}

(Click to expand) features.claimsParameter options details

assertClaimsParameter

Specifies a helper function that validates individual claim requests in the parsed claims parameter. The default implementation requires each member of userinfo and id_token to be null or a JSON object, as defined by OIDC Core. A custom implementation may accept extension syntax or enforce deployment-specific policies. JSON parsing and validation of the top-level object and its userinfo and id_token containers are always performed before this function is invoked.

The function may throw errors to reject non-compliant claims requests or return successfully to indicate acceptance of the claims parameter content. Accepting extension syntax does not add support for its consent, claim selection, or response processing requirements.

default value:

async function assertClaimsParameter(
  ctx: KoaContextWithOIDC,
  claims: Partial<Record<"userinfo" | "id_token", UnknownObject | undefined>>,
  client: Client,
): Promise<void> {
  for (const container of ['userinfo', 'id_token']) {
    if (claims[container] !== undefined) {
      for (const value of Object.values(claims[container])) {
        if (value !== null && !isJsonObject(value)) {
          throw new errors.InvalidRequest(`claims.${container} members must be null or objects`);
        }
      }
    }
  }
}

---