A customer wishes to customize the OpenID Connect (OIDC) id_token JSON Web Token (JWT) to include the subject's employee number. Which of the…

The OIDC Claims Script is the designated scripting point in PingAM for customizing the contents of an OpenID Connect idtoken. This script can be used to add, modify, or remove claims before the token is issued. To add a custom claim like an employee number, an administrator would implement logic within this script to retrieve the value from the user's profile and insert it into the claims set that will be used to build the final JWT.

A. OIDC parameters script: This script modifies authorization and token endpoint request/response parameters, not the claims inside the idtoken JWT.

C. OIDC attributes script: This is not a standard, recognized script type in PingAM for this purpose. The OIDC Claims Script is the correct tool.

D. OIDC JWT script: This is not a standard script type in PingAM. While it relates to JWTs, the specific script for idtoken claims is the OIDC Claims Script.

1. Ping Identity, PingAM Documentation, "Scripting guide" > "Script types" > "OIDC claims script". (The documentation explicitly states, "The OIDC claims script lets you customize the claims returned in ID tokens, and from the UserInfo endpoint.").