Automattic / Automattic/wp-openid-connect-server

How to add email claim using oidc_user_claims ?

Open
#91 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
44
Forks
13
PR merge metrics
No merged PRs in 30d

Description

Hey folks!

I'm trying to use this in conjection with https://github.com/mesosphere/traefik-forward-auth - I need an email claim to validate, so I tried the following client setup:

```
add_filter( 'oidc_registered_clients', 'my_oidc_clients' );
function my_oidc_clients() {
return array(
'clientid' => array(
'name' => 'My Awesome Name',
'secret' => 'clientsecret',
'grant_types' => array( 'authorization_code' ),
'scope' => 'openid profile email'
),
);
}
```

And then I added:

```
add_filter( 'oidc_user_claims', 'my_user_claims', 10, 2 );
function my_user_claims($claims, $user) {
$claims['email'] = $user->user_email;
return $claims;
}
```

Hoping to get the email address returned. However, my claim (when debugged with https://openidconnect.net/), doesn't show the email field.

Have I misunderstood how to achieve this? :)

Thanks!
D

Contributor guide

Open the contributing guide

Research direction

Start by tracing the oidc_user_claims filter and the oidc_registered_clients configuration in the plugin, then reproduce the authorization-code flow with the shown client and email scope. Confirm whether the returned claims include email when inspected with openidconnect.net; document the required configuration or identify the failing path.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.