OIDC Scopes and Claims

The following is a list of the supported scopes and claims for the UC Berkeley OIDC protocol.

Standard Claims

Standard OIDC scopes and the specific user claims they provide.

Scope	Claim(s)	Data Source / Description	Visibility
openid	sub	berkeleyEduKerberosPrincipalString (default)	Public
	iss	Issuer of the response (URL)	Public
	aud	Audience for the ID token (client_id)	Public
	exp	Expiration time of the ID token	Public
	iat	Time at which the JWT was issued	Public
profile	family_name	sn	Public
	given_name	givenName	Public
	name	displayName	Public
	preferred_username	berkeleyEduKerberosPrincipalString	Public
email	email	berkeleyEduAlternateID	Private

---

Custom Claims

Custom UC Berkeley OIDC scopes for extended user attributes.

Scope	Claim(s)	Data Source	Visibility
berkeley_edu_default	uid	uid	Private
	affiliations	berkeleyEduAffiliations	Public
	groups	berkeleyEduIsMemberOf	Private
berkeley_edu_groups	groups	berkeleyEduIsMemberOf	Private
berkeley_edu_dept_number	department_number	departmentNumber	Public
berkeley_edu_employee_id	employee_id	berkeleyEduUCPathID	Private
berkeley_edu_cs_id	cs_id	berkeleyEduCSID	Private
berkeley_edu_student_id	student_id	berkeleyEduStuID	Private
berkeley_edu_ou	ou	ou	Public

---