OIDC Attributes (Claims)

Creating or updating the OIDC App

1. Log in to the JumpCloud Administrator Portal.
2. Navigate to USER AUTHENTICATION > SSO.
3. For a new application:
   1. Click + Add New Application.
   2. Click Custom OIDC App. 
   3. Enter a name in the Display Label field. Optionally you can add a Description and adjust the Display Option.
   4. Select the SSO tab.
   5. Under Attribute Mapping (optional), use Standard Scopes and configure user, constant, and group attributes. 
   6. Click activate. 
4. For an existing application:
   1. Search for and select the desired application.
   2. Select the SSO tab.
   3. Under Attribute Mapping (optional), use Standard Scopes and configure user, constant, and group attributes.
   4. Click save. 

Attribute Mappings (optional)

Standard Scopes

Scopes are space-separated lists of identifiers used to specify what access privileges are being requested. JumpCloud supports two of OIDC's built in scope identifiers. Each scope includes different user attributes that are sometimes required by the Service Provider.

Scope Values

• openid is required for any OpenID request connect flow. If the openid scope value isn’t present, the request may be a valid OAuth 2.0 request, but it’s not an OpenID Connect request.
• profile requests access to these default profile claims: family_name, given_name.
• offline_access can only be requested in combination with a response_type that contains code. If the response_type doesn’t contain code, offline_access is ignored.

A Standard Scope can be added to the connector by selecting one or both of the scopes.

Additional User Attributes

Additional attributes can be added to the OIDC connector with or without Standard Scopes. There are three types of attributes available.

User Attribute Mapping

• User-specific attributes sent to the Service Provider. For example, the Service Provider requires the location and job title for each user. Mapping those two attributes to JumpCloud attributes will add those claims (attributes) to the ID token.

Constant Attributes

• Constant-value attributes sent to the Service Provider. For example, a constant attribute for session duration limits session times for all users of the application, or service provider. 

Group Attributes

• Groups that connect the user to the application are included in assertions to that application. The Groups Attribute Name is the service provider’s name of the group attribute (e.g. memberOf). 
• If the Group Attribute option is selected and the field is prepopulated with the group attribute name, that means we’ve validated that the group attribute is supported by the service provider. If the group attribute option isn’t selected and the Group Attribute Name field is empty, you need to find out if the service provider supports group attributes on your own. 

• Group attributes may be used in some service providers to map roles.