คำขอ Claims และ Claims แบบรวม

Beyond scopes like profile or email, OIDC offers a finer-grained claims request parameter. It lets a client ask for individual claims and target where they appear: in the ID token or from UserInfo.

The claims parameter is a JSON object with two top-level members: id_token and userinfo. Each maps claim names to a value describing how they are requested.

Each requested claim can specify:

• essential: true — the client really needs it.
• value — request that the claim equals a specific value.
• values — request one of several allowed values.

The JSON is URL-encoded and sent as the claims query parameter on the authorization request.

Scopes bundle many claims at once. The claims parameter is for when you need precision — a single specific claim, an essential requirement, or a constraint on its value. It complements scopes rather than replacing them.

Sometimes claims come from a third party the OP trusts. Aggregated claims are bundled by the OP as a signed JWT from the external claims provider and returned inline, so the client gets verifiable assertions without extra calls.

The OP references them via _claim_names (which claim came from which source) and _claim_sources (the JWT holding them).

Distributed claims are not embedded; instead the OP gives an endpoint and access token so the client can fetch them directly from the external source when needed.

The trade-off:

• Aggregated — claims travel inline, fewer round-trips, larger token.
• Distributed — claims fetched on demand, smaller token, extra request and live availability of the source.

For aggregated claims, verify the embedded JWT's signature against the claims provider's keys. For distributed claims, call the endpoint with the supplied access token and validate the returned JWT before trusting any values.

External claim mechanisms shine in federations: an identity provider asserts who you are, while a bank or government source asserts verified attributes. They keep sensitive data at its authoritative source.

The claims parameter enables fine-grained, essential, or value-constrained claim requests targeting the ID token or UserInfo.

• essential, value, and values refine each request.
• Aggregated claims are embedded inline as signed JWTs.
• Distributed claims are fetched from an external endpoint.
• Always verify external claim signatures before trusting them.