Set id_token audience

[kotyara85]

Hello everyone,
We're running v1.11.10, no way to migrate to v2 right now.
As a part of Consent workflow audience is being set from url params and passed in consent workflow

GrantAccessTokenAudience: consentRequest.GetRequestedAccessTokenAudience()

I did confirm the audience is being passed:

http_request=map[headers:map[accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 accept-encoding:gzip, deflate, br accept-language:en-US,en;q=0.9 cache-control:max-age=0 connection:keep-alive cookie:[oauth2_authentication_csrf_insecure=MTY4NjYyNDg3NHxEdi1CQkFFQ180SUFBUkFCRUFBQVB2LUNBQUVHYzNSeWFXNW5EQVlBQkdOemNtWUdjM1J5YVc1bkRDSUFJRFpqTnpZek4yVXpNV1kyTnpRNFl6QmlPRFF5TkRobFpUUTFPRE0xWldNNHyfHuOHMNYCjct3mvJgO5ALl3srZTcIkBc3zXsrSxVJZw==; oauth2_authentication_session_insecure=MTY4NjYyNDg4N3xEdi1CQkFFQ180SUFBUkFCRUFBQVFmLUNBQUVHYzNSeWFXNW5EQVVBQTNOcFpBWnpkSEpwYm1jTUpnQWtZV0UwTmpoaVptSXRPVGhpTnkwME5UQm1MV0prWkRjdE5tSmhZbUl4WlRrMVpHWTJ80vGJas-cGF6p8eEsU650T0gwHRfQRMbejc75bV0d8R8=; oauth2_consent_csrf_insecure=MTY4NjYyNDg4N3xEdi1CQkFFQ180SUFBUkFCRUFBQVB2LUNBQUVHYzNSeWFXNW5EQVlBQkdOemNtWUdjM1J5YVc1bkRDSUFJRGd4TTJJM00yTmxOVEV5TWpRd09XUmlNamxrT1RFek0yTmxOR0prTkdVMHwhiQMYspBPP5jjiQurxkkyHpBRfe2oEZiVs0wu4DUeyw==] sec-ch-ua:"Google Chrome";v="113", "Chromium";v="113", "Not-A.Brand";v="24" sec-ch-ua-mobile:?0 sec-ch-ua-platform:"macOS" sec-fetch-dest:document sec-fetch-mode:navigate sec-fetch-site:cross-site upgrade-insecure-requests:1 user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36] host:127.0.0.1:4444 method:GET path:/oauth2/auth query:access_type=offline&audience=test&client_id=clien1&consent_verifier=79cb04e50c8b4587aca2371615f1f6d7&redirect_uri=http%3A%2F%2Flocalhost%3A9999%2Fcallback&response_type=code&scope=openid+offline_access+profile&state=1069e2a4bc4dfb2754352a94d2c857f9 remote:127.0.0.1:56674 scheme:http]

Access token audience is set correctly, but id_token is ignored.
Is there a way to overwrite it?
Any help is appreciated

Thanks

[aeneasr]

I don't believe you can override the audience for ID Tokens, because the audience for ID Tokens is always the OAuth2 Client per spec.

[vinckr]

Hey @kotyara85
Just checking in if your question was answered or if there was still something unclear.
I will mark this as answered for now, but feel free to come back to the discussion any time.

Thanks a ton! 🐝