We are using Keycloak to generate OpenId tokens, now they want to use Salesforce Identity to do that, the thing is that the have some custom claims in the JWT token that we are not able to include in OAuth flow like the Web Server Auth Flow or User-Agent flow as we can't modify the JWT as we can do in the JWT Bearer Token Flow.

The custom claim is something like this, an object with an array inside.

"realm_access": {

"roles": [







As far as I read in the documentation we can include custom attributes from the User, Profile and Role in the Connected App "Include Custom Attributes" but not a complex structure like the one above.

If anyone has dealt with this custom OpenId token with Web Server Auth Flow please comment about the approach you did to include these custom claims into the JWT Open Id.


You may be able to set custom claims via the JWT Class if you are creating your own Authentication Provider in Salesforce.


Your understanding is correct. Out of the box, you can receive an OpenID Connect id token if you request openid scope but you have limited control over non-standard claims in this token. If you need your own claims in your own format, you'll need to perform a token exchange as a 2-step process:

  1. Your oAuth client acquires an access token from SF using one of the supported oAuth flows
  2. Use the access token in another call to SF to exchange for your own token. The 2nd call will be to your own, custom REST API that will produce your own, custom JWT. See Using JWT when calling out from Salesforce to third party API for an example of how to generate the token.

I found a way to include custom attributes in the JWT token from the Connected App programatically. Connected App plugin: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_class_Auth_ConnectedAppPlugin.htm

I have created a class extending the above one and using the following method:

global override Map<String,String> customAttributes(Id userId, Id connectedAppId, Map<String,String>
        formulaDefinedAttributes, Auth.InvocationContext context) 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.