OIDC Scopes and Claims: A Practical Reference for SaaS Developers

OpenID Connect (OIDC) Core 1.0 specification defines how applications can request user identity data through scopes and receive that data as claims. Scopes, such as openid, profile, email, address, and phone, are space-separated keywords sent in the authorization request that dictate which user attributes are returned as claims. The openid scope is mandatory for an OIDC request, ensuring the return of the sub claim, a stable user identifier, while other scopes like profile and email provide additional user details such as names and email addresses. Providers may return claims directly in the ID token or require a call to the UserInfo endpoint to retrieve them, with some providers like Okta and Microsoft Entra ID offering custom claims and handling large data like user groups differently. The sub claim is recommended as a stable user identifier, while email and other mutable attributes should be treated as display data. SSOJet offers a solution by acting as an OpenID Connect provider, normalizing differences in provider-specific claims, and facilitating enterprise SSO integration.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.