# Custom claims under OIDC Enterprise Connection User Mapping not included on id\_token

**URL:** <https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322>\
**Category:** Get Help\
**Tags:** oidc-enterprise-connection, connections\
**Created:** [October 11, 2023, 3:29pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322 "2023-10-11T15:29:43Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![will.bastian](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@will.bastian](https://community.auth0.com/u/will.bastian)\
**Post date:** [October 11, 2023, 3:29pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/1 "2023-10-11T15:29:43Z")

</div>

The [auth0 docs for OIDC attribute mapping](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc) provide numerous examples of providing custom claims. For instance, it includes this example of providing a `sf_community_id` field:

```auto
"attribute_map": {
    . . .
    “attributes”: {
        …
        “sf_community_id”: “3423409219032-32”
    }
}

```

However, I believe I’m observing that the claim mapping only supports the [non-restricted claims](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#non-restricted-claims) list for the mapping, as evidenced by the `id_token` generated by the following mapping:

```auto
{
  "attributes": {
    "name": "${context.userinfo.given_name}",
    "email": "${context.userinfo.email}",
    "birthdate": "${context.userinfo.birthdate}",
    "family_name": "${context.userinfo.family_name}",
    "phone_number": "${context.userinfo.phone_number}",
    "sf_community_id": "123456",
    "nickname": "foo"
  },
  "mapping_mode": "use_map"
}

```

```auto
{
  "family_name": "<redacted>",
  "nickname": "foo",
  "name": "<redacted>",
  "picture": "<redacted>",
  "birthdate": "<redacted>",
  "updated_at": "2023-10-11T15:21:11.900Z",
  "email": "<redacted>",
  "iss": "<redacted>",
  "aud": "<redacted>",
  "iat": 1697037672,
  "exp": 1697073672,
  "sub": "<redacted>",
  "sid": "<redacted>",
  "nonce": "<redacted>"
}

```

Here, we see “nickname” has been set to the constant “foo”, but there is no “sf\_community\_id” present.

In our example we desire to map custom claims from the external IDPs `userinfo`, in a manner consistent with the other userinfo fields.

The docs indicate that this should be supported, and I’m unclear if there are any other dependencies I’m not tracking.

What is the recommended approach to solve for this mapping scenario?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 17, 2023, 7:53pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/3 "2023-10-17T19:53:05Z")

</div>

Hi @will.bastian,

Welcome to the Auth0 Community!

Would you mind DMing me the name of the tenant so I can take a look?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 19, 2023, 6:28pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/4 "2023-10-19T18:28:41Z")

</div>

Thanks for providing your tenant name.

I was able to get the “sf\_community\_id” in the ID token by setting up an Action to add it as a custom claim. I’m unable to find any other way to get it in the token, including adding the claim to the `scope` param with the request.

Here’s the Action I used:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.sf_community_id) {
    api.idToken.setCustomClaim("sf_community_id", event.user.sf_community_id)
  }
};

```

Hope that helps!

---

<div class="post-metadata">

**Author:** ![will.bastian](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@will.bastian](https://community.auth0.com/u/will.bastian)\
**Post date:** [October 19, 2023, 10:17pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/5 "2023-10-19T22:17:17Z")

</div>

Hey Dan, Thanks! This does indeed solve for the asked question of how to define a custom claim in the OIDC user mapping, and including it on the id\_token.

In exploring this further in our specific use cases I’m now met with a following question:  
If one of our claim’s contents is an object, is there any means to pull specific fields out of the source object and into our custom claims?

For instance, let’s reference a claim on `userinfo` named `my_object_claim` that contains an object with a single element, `my_subobject`

```auto
"my_object_claim": {"my_subobject": "foo"}

```

–1–  
I’m finding that if we apply this mapping at the `my_object_claim` level, we’re met with the contents of

```auto
"my_object_claim": "[object Object]",

```

in the id\_token

This is through providing both the user mapping, and the appropriate action

mapping:

```auto
  "attributes": {
    "name": "${context.userinfo.given_name}",
    "my_object_claim": "${context.userinfo.my_object_claim}"
  },

```

action:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.my_object_claim) {
    api.idToken.setCustomClaim("my_object_claim", event.user.my_object_claim)
  }
};

```

–2–  
Then, if we attempt to update the user mapping json definition to go the level further into the object contents of `my_object_claim`, we cannot chain object element lookup past the top level claim.

If we update our user mapping to be:

```auto
  "attributes": {
    "name": "${context.userinfo.given_name}",
    "my_subobject_claim": "${context.userinfo.my_object_claim.my_subobject}"
  },

```

We’re met with:

```auto
expected context.tokenset, context.connection or contect.userinfo property access: "my_subobject_claim" ${context.userinfo.my_object_claim.my_subobjectd} found: Identifier

```

–3–  
Finally, as in 1, above, it appears we’ve already called translated `my_object_claim` to `"[object Object]"`, perhaps via calling toString on it? This appears to indicate while we have the ability to update the action to introspect further into the object, it’s already a string and there’s nothing to further introspect beyond the string contents of `"[object Object]"`

So, doing something like

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.my_object_claim) {
    api.idToken.setCustomClaim("my_object_claim", event.user.my_object_claim.my_subobject_claim)
  }
};

```

Returns `null`

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 24, 2023, 1:44pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/6 "2023-10-24T13:44:22Z")

</div>

Thanks for the thorough write up.

Just to confirm, when the user mapping happens (not the Action), the object is casted to a string and retains just the placeholder `"[object Object]"` string. Then in the action, that is all that is available.

Is that what you see in the user’s profile in the dashboard too?

---

<div class="post-metadata">

**Author:** ![will.bastian](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@will.bastian](https://community.auth0.com/u/will.bastian)\
**Post date:** [October 24, 2023, 1:56pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/7 "2023-10-24T13:56:06Z")

</div>

Hey Dan, that is an accurate summary of my working hypothesis. The `"[object Object]"` serialization is present on both the id\_token, as well as the user profile raw json in the dashboard.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 24, 2023, 2:29pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/8 "2023-10-24T14:29:21Z")

</div>

Thanks for the confirmation. I’m going to reach out to the team and see if I can get a definitive answer.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 27, 2023, 1:13pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/10 "2023-10-27T13:13:43Z")

</div>

Hi @will.bastian,

I wasn’t able to find a definitive answer on this. I suspect that object literals aren’t supported in this case. Can you please create a feature request in our #Feedback category?

---

<div class="post-metadata">

**Author:** ![will.bastian](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@will.bastian](https://community.auth0.com/u/will.bastian)\
**Post date:** [October 27, 2023, 2:12pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/11 "2023-10-27T14:12:56Z")

</div>

Hey @dan.woda - Thanks for digging into it. I’ve created a feature request at [Allow object mapping/introspection in Enterprise OIDC custom claim mapping](https://community.auth0.com/t/allow-object-mapping-introspection-in-enterprise-oidc-custom-claim-mapping/119559)

For posterity, and anybody who finds themselves in a similar scenario, our workaround is to leverage `context.tokenset.access_token` mapping in the enterprise OIDC connection, and subsequently using the `access_token` now present on the `id_token` to make an explicit call to the external IDP’s `userinfo` to pull the information we need out of the object claim.

Separately, are there means or channels to propose update to the Auth0 docs? Your clarification around the necessity of leveraging an action to map the custom claims defined in the enterprise OIDC connection was instrumental in this all making sense, and I feel it would be a strong addition to the existing doc at [Configure PKCE and Claim Mapping for OIDC Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc)

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 27, 2023, 2:18pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/12 "2023-10-27T14:18:41Z")

</div>

Thanks for the thorough write-up!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 10, 2023, 2:19pm UTC](https://community.auth0.com/t/custom-claims-under-oidc-enterprise-connection-user-mapping-not-included-on-id-token/118322/13 "2023-11-10T14:19:22Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.