How to add additional claims to Dex token from upstream oidc token

[addevine]

Using the oidc connector to login to upstream Okta, I'd like to include a "clients" claim to the Dex JWT. Is there a way to add this claim from the upstream oidc token to the Dex token?

Logging in with Okta oidc provides a claim named "clients" in its token
{ .... "clients": .., .... }

However the token from Dex does not include this "clients" claim. Is there a way to add it? I've tried claim mappings to made groups map to clients, but as shows below there is not even a groups in this Dex token.
{ "iss": "...", "sub": "...", "aud": "...", "exp": ..., "iat": ..., "at_hash": "...-", "email": "...", "email_verified": ..., "name": "..." }

[nabokihms]

Hello, @addevine.

1. At the current time, there is no way to add custom claims to a dex id token. We want to implement this logic in the future as a part of solving this issue Connector middleware #1635
2. I assume your application does not send the groups scope, so there is no groups claim in the token.

[addevine]

Thank you for the response! Correct, the app is not sending groups (they put what would I'd expect to be in groups in some custom claim named "clients"). Do you think if we can have the upstream oidc provider send an empty group claim, we could then use dex claim mapping to map the custom claim to the groups?

claimMapping: groups: "clients"

If not, I need to see if they can just use groups instead of their custom claim, but I have no control over the app hence why I'm trying the above solution! Thank you!

[nabokihms]

I think this is not your upstream provider case. Your application needs to request the groups scope on login. You must provide scopes via a GET parameter when you redirect a user from your application page to Dex for a login procedure.

There is an example of an authentication request to Dex:

http://127.0.0.1:5556/dex/auth
  ?client_id=example-app  <-- client to use
  &redirect_uri=http://127.0.0.1:5555/callback    <-- your app callback address
  &scope=groups+openid+profile+email+offline_access  <-- must include groups
  &response_type=code
  &state=I+wish+to+wash+my+irish+wristwatch