声明请求与聚合声明
了解 OpenID Connect 如何让客户端通过 claims 参数请求特定声明，以及分布式声明和聚合声明如何从外部来源提供断言。
声明请求与聚合声明 是 CoddyKit 上的免费 OAuth2 & OpenID Connect Deep Dive 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 OAuth2 & OpenID Connect Deep Dive 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 OAuth2 & OpenID Connect Deep Dive 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Requesting Specific Claims
Beyond scopes like profile or email, OIDC offers a finer-grained claims request parameter. It lets a client ask for individual claims and target where they appear: in the ID token or from UserInfo.
The claims Parameter Shape
The claims parameter is a JSON object with two top-level members: id_token and userinfo. Each maps claim names to a value describing how they are requested.
{
"id_token": { "auth_time": { "essential": true } },
"userinfo": { "email": null, "email_verified": null }
}essential, value, values
Each requested claim can specify:
essential: true— the client really needs it.value— request that the claim equals a specific value.values— request one of several allowed values.
{ "acr": { "essential": true,
"values": ["urn:mace:incommon:iap:silver"] } }Sending It in the Request
The JSON is URL-encoded and sent as the claims query parameter on the authorization request.
GET /authorize?response_type=code
&client_id=app123&scope=openid
&claims=%7B%22id_token%22%3A%7B%22auth_time%22%3A%7B%22essential%22%3Atrue%7D%7D%7DWhy Not Just Scopes?
Scopes bundle many claims at once. The claims parameter is for when you need precision — a single specific claim, an essential requirement, or a constraint on its value. It complements scopes rather than replacing them.
Aggregated Claims
Sometimes claims come from a third party the OP trusts. Aggregated claims are bundled by the OP as a signed JWT from the external claims provider and returned inline, so the client gets verifiable assertions without extra calls.
Aggregated Claims Format
The OP references them via _claim_names (which claim came from which source) and _claim_sources (the JWT holding them).
{
"_claim_names": { "address": "src1" },
"_claim_sources": {
"src1": { "JWT": "eyJhbGciOi..." }
}
}Distributed Claims
Distributed claims are not embedded; instead the OP gives an endpoint and access token so the client can fetch them directly from the external source when needed.
{
"_claim_names": { "payment_info": "src2" },
"_claim_sources": {
"src2": {
"endpoint": "https://bank.example.com/claims",
"access_token": "ksj3n283dke"
}
}
}Aggregated vs Distributed
The trade-off:
- Aggregated — claims travel inline, fewer round-trips, larger token.
- Distributed — claims fetched on demand, smaller token, extra request and live availability of the source.
Processing External Claims
For aggregated claims, verify the embedded JWT's signature against the claims provider's keys. For distributed claims, call the endpoint with the supplied access token and validate the returned JWT before trusting any values.
When to Use These
External claim mechanisms shine in federations: an identity provider asserts who you are, while a bank or government source asserts verified attributes. They keep sensitive data at its authoritative source.
Quick Check
Test your understanding of claim requests.
Recap
The claims parameter enables fine-grained, essential, or value-constrained claim requests targeting the ID token or UserInfo.
essential,value, andvaluesrefine each request.- Aggregated claims are embedded inline as signed JWTs.
- Distributed claims are fetched from an external endpoint.
- Always verify external claim signatures before trusting them.
用 AI 导师学习 OAuth2 & OpenID Connect Deep Dive — 免费
在浏览器中编写并运行真实代码，获得全天候 AI 导师的即时帮助，并在网页或应用中继续学习。
- 课程
- 12
- 课程
- 48
常见问题解答
「声明请求与聚合声明」课时是免费的吗？
是的 — 「声明请求与聚合声明」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 OAuth2 & OpenID Connect Deep Dive 课程的其余内容，请升级到 CoddyKit PRO。 OAuth2 & OpenID Connect Deep Dive 课程共包含 4 节课。
「声明请求与聚合声明」这节课中我会学到什么？
了解 OpenID Connect 如何让客户端通过 claims 参数请求特定声明，以及分布式声明和聚合声明如何从外部来源提供断言。 你通过在浏览器中直接运行的动手代码来练习 OAuth2 & OpenID Connect Deep Dive，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 OAuth2 & OpenID Connect Deep Dive 需要有经验吗？
无需任何先前经验。CoddyKit 上的 OAuth2 & OpenID Connect Deep Dive 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「声明请求与聚合声明」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 OAuth2 & OpenID Connect Deep Dive 课中编写并运行代码吗？
能。每节 OAuth2 & OpenID Connect Deep Dive 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。