Reading OIDC Token within IG

Tagged: , , ,

This topic has 7 replies, 4 voices, and was last updated 2 years, 6 months ago by violette.

  • Author
  • #26085

    I am using IG for API endpoint protection. Currently IG and AM are configured to complete OAuth authentication and also pass back an ID_token. I would like for IG to take in the ID_token with an additional call and convert some of the attributes contended in the id_token to headers values. Does anyone have an example of this use case? Do I need to use the token transformation filter? The example I found was using SAML and that will not work for my use case.


    Hello reeprice,

    If you are using an OAuth2ClientFilter, you should be able to access the openid attributes by using ${attributes.openid}.
    The IdToken is available in ${attributes.openid.id_token}.
    The claims are available in ${attributes.openid.id_token_claims}.
    Then, you can use a HeaderFilter to place the values in a header.

    You can use the HeaderFilter after the Oauth2ClientFilter, such as:

      "type": "HeaderFilter",
      "config": {
        "messageType": "REQUEST",
        "add": {
          "myIdToken": [

    Which type of call/modifications do you need to do on the claims?


    • This reply was modified 3 years, 4 months ago by violette.

    I am using OAuth2ResourceServerFilter to validate my Access token. Can OAuth2ClientFilter do this as well? Do you have an example of this use case. Basically I want to make two calls. The first call I get an Access Token and id_token. On the 2nd call the access token is validated and the id_token values are saved into context to be used by additional filter.


    Without routes context, I can only said that the OAuth2ResourceServerFilter validates a Request that contains an OAuth 2.0 access token and The OAuth2ClientFilter is responsible for authenticating the end-user using OAuth2/OIDC delegated authorization. This is two different use cases.

    In your case, you are using IG as a Relying Party, such as described in, for validating the access_token.
    If your token is validated, then you can add a ScriptableFilter after the OAuth2ResourceServerFilter to extract id_token value(provided as a header from your AM) and perform some modifications on its claims. Then, once your modifications are done, you can use a HeaderFilter.

    Do I need to use the token transformation filter?

    > No, except if you want to transform your id_token into SAML assertions.

    • This reply was modified 3 years, 4 months ago by violette.

    I’d love to see an example of a ScriptableFilter extracting a claim value from an access_token. For instance if I’ve added mail as a scope on the AM side, and I’ve got an OAuth2ClientFilter functioning, what would the ScriptableFilter look like to pull out mail, so that I can insert it into a header value?
    In other words, I want to use OAuth for auth/scope request, and when IG sees the token result, I want to extract the mail (and a roles/isMemberOf array) from the access token and shove it into a header. I can add the token as a whole, (and the id_token too) with ${attributes.openid.access_token} but I can’t seem to get at the claim values. Does the Client filter not do that type of introspection or make the claim values available? Your note stating “perform some modifications on its claims” makes me think this is possible.


     Jatinder Singh

    Access Token is essentially a JWT and you can parse it using the below code in your ScriptableFilter

    import org.forgerock.json.jose.common.JwtReconstruction
    import org.forgerock.json.jose.jws.SignedJwt
    import groovy.json.JsonSlurper
    SignedJwt jwt = new JwtReconstruction().reconstructJwt(accessToken, SignedJwt)
    claimsSet = new JsonSlurper().parseText(jwt.getClaimsSet.toString())

    Hope this helps!



    I am having some issues configuring IG to be the PEP for AM, I am using AM as the PDP. Set up everything as per the forge rock documentation.

    But I am still getting the following error, does anyone have any idea ??

    [http-nio-8082-exec-6] ERROR o.f.o.h.r.RoutesCollectionProvider @system - An error occurred while trying to create route 151 Authentication failed
    Wrapped by: java.lang.IllegalStateException: Unable to start notification service
    Wrapped by: org.forgerock.openig.heap.HeapException: Invalid object declaration
    	at org.forgerock.openig.heap.HeapImpl.get(
    Wrapped by: org.forgerock.openig.handler.router.RouterHandlerException: An error occurred while loading the route with the name '151_CDR_Oauth2_Routes'
    	at org.forgerock.openig.handler.router.RouterHandler.load(

    Hello Kian,
    The error message you have: Authentication failed means that the credentials are incorrectly set in your AmService object.


Viewing 8 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic.

©2022 ForgeRock - we provide an identity and access platform to secure every online relationship for the enterprise market, educational sector and even entire countries. Click to view our privacy policy and terms of use.

Log in with your credentials

Forgot your details?