Custom JWT claim mappings
Teams can define custom claim mappings that are resolved into issued tokens per environment.
From the changelog: Custom JWT claim mappings
Authdog Team
Applications often need roles, groups, or a few profile attributes on the token itself so every request does not hit a directory lookup. Authdog already issued a standard claim set. Environments can now add custom claim mappings that are resolved when a token is issued.
This is the longer note behind the July 17 changelog entry.
How it works
Each environment has a JWT claims module. You author a JSON document that maps a claim name to a source. The console editor is Monaco-based and validates the document before save.
Sources that shipped with the module:
- roles — role slugs for the user
- groups — group slugs for the user
- static — a fixed literal you set on the mapping
- metadata — a value from the user's metadata, keyed by name
Mappings are applied at issuance. New tokens pick up the saved document; existing tokens are not rewritten.
Custom claims are additive. They do not replace the standard claim set, and a broken mapping does not block sign-in. Setup and emission rules live in JWT claims.
Set it up
In the Authdog console, open Authentication > JWT Claims:
- Select the project and environment.
- Edit the claims document in the JSON editor.
- Map claim names to role, group, static, or metadata sources.
- Save. The editor refuses an invalid document.
Exercise a fresh sign-in and inspect the issued token. Claims configured after a session started will not appear until the next issuance.
Trust boundaries
A custom claim is a convenience for the application, not a substitute for server-side authorization. Treat a missing claim as no grant. Reserved claims used for verification (iss, sub, aud, and the rest listed in the JWT claims docs) are dropped rather than overwritten.
Claim resolution is best-effort. A transient lookup failure issues the standard claim set only. Do not build a security control that assumes a custom claim is always present.
Try it
Author a small mapping in Authentication > JWT Claims, then sign in again. Configuration is in JWT claims. The original release note is in the changelog.