> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure an OIDC and OAuth claim

You can include IDaaS authenticators, groups, and organizations as part of the OIDC claim to an application during authentication. These are called **User Related Attributes** on IDaaS. For example, if a user authenticated using an OTP and Password authenticator and belonged to Group1, Group2, and Group3, and were associated with organizations MyOrganization and Beta, then the token responses can be configured to include these claims, as shown in this example:

```json
{
  "authenticators": ["NONE:OTP", "PASSWORD:OTP", "PASSWORD:NONE"],
  "groups": ["Group1", "Group2", "SomeOtherGroup"],
  "organizations": ["MyOrganization", "Beta"]
}
```

note

User groups, authenticators, and organizations are multi-valued fields and are sent as unsorted arrays.

IDaaS supports customizing OIDC claims to include User Related Attributes for the following applications:

- [Integrate a generic OIDC and OAuth Web application](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-web-application.md)
- [Integrate a generic OIDC and OAuth SPA application](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-spa-application.md)
- [Integrate a generic OIDC and OAuth Device application](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-device-application.md)
- [Integrate a generic OIDC and OAuth Native application](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-native-application.md)

These attributes are not tied directly with a user's record but are associated with the user through other entities or session information.

## Configure OIDC and OAuth claim to include user authenticators, groups, or organizations

1. Log in to your IDaaS account.
2. Click Menu icon > **Security** > **Applications**. The **Applications** page appears.
3. Click the OIDC application that you want to configure with custom claims. The **Edit Applications** page appears.
4. Click **Next**. The **General Settings and Authentication Settings** page appears.
5. Go to the **Supported Claims** section.
6. Click Circle Plus icon. The **Add Claim** dialog box appears.
   1. In the **Open ID Claim** section, do one of the following:
      - Scroll to select the claim name to use to create a custom claim (for example, `groups`).
   2. From the **Association Type** drop-down list, select **User Related Value**.
   3. Configure the **Association Value**, based on the information required:
      - Select **[Authenticators]** to include a user's authenticators every time they authenticate.
      - Select **[Groups]** to include the user's IDaaS groups every time they authenticate.
      - Select **[Unique Group IDs]** to include the user's IDaaS group ids every time they authenticate.
      - Select **[Organizations]** to include a list of the user's organizations every time they authenticate.
      - Select **[Unique Organization IDs]** to include a list of the user's organization ids every time they authenticate.
      - Select **[Selected Organization]** to include the user's selected organization every time they authenticate.
      - Select **[Unique Selected Organization ID]** to include the user's selected organization ID every time they authenticate.
7. Click **Add**. You are returned to the list of **Supported Claims**.
8. Click **Submit**.