We are using Keycloak to generate OpenID Connect id tokens, now they want to use Salesforce Identity to do that. We have some custom claims in the id token returned by Keycloak that we are not able to include with Salesforce. We tried oAuth flows such as Web Server or User-Agent but we can't modify the access token returned in these flows.

The custom claim is something like this, an object with an array inside.

   "roles": ["ROLE_1", "ROLE_2", "ROLE_3", "ROLE_4", "ROLE_5"]

Documentation states that we can include custom attributes in the ID token from the User, Profile and Role by selecting Configure ID Token and then ticking Include Custom Attributes on the Connected App. This does not meet our needs.


You may be able to set custom claims via the JWT Class if you are creating your own Authentication Provider in Salesforce.


Your understanding is correct. Out of the box, you can receive an OpenID Connect id token if you request openid scope but you have limited control over non-standard claims in this token. If you need your own claims in your own format, you'll need to perform a token exchange as a 2-step process:

  1. Your oAuth client acquires an access token from SF using one of the supported oAuth flows
  2. Use the access token in another call to SF to exchange for your own token. The 2nd call will be to your own, custom REST API that will produce your own, custom JWT. See Using JWT when calling out from Salesforce to third party API for an example of how to generate the token.

I found a way to include custom attributes in the JWT token from the Connected App programatically. Connected App plugin: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_class_Auth_ConnectedAppPlugin.htm

I have created a class extending the above one and using the following method:

global override Map<String,String> customAttributes(Id userId, Id connectedAppId, Map<String,String>
        formulaDefinedAttributes, Auth.InvocationContext context) 
  • We haven't been able to reproduce this answer. To the best of our knowledge, connected app plugin cannot dynamically inject attributes into an OpenID Connect id token.
    – identigral
    Feb 6 '20 at 17:10
  • Method customAttributes from the Auth.ConnectedAppPlugin class that you include into the Connected App will do the magic. The Map<String,String> is injected in the OpenID Connect token. Feb 7 '20 at 20:41
  • Yup, tried it. Did not work in OpenID Connect flow for us.
    – identigral
    Feb 7 '20 at 23:32
  • Have you set Configure ID Token in the connected app, including Standard and custom claims?. You would need to set the ID Token Audiences with the domain that will manage the ID Token. In the Apex plugin class you can set your Admin user and check for the traces in dev console in the execution to check for any failures. Feb 27 '20 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.