Custom claims with ADFS

[Ssshafi]

Hello,
I manage to get OIDC auth. working in my test lab.
But I couldn't find how to get get custom claims sent by my ADFS server in headers variables.
Is there any parameter that I missed ?

Environment : Debian 12 / Apache 2.4 / php 8.3 / mod_auth_openidc 2.4.12 / ADFS 2019

Apache config. :

OIDCProviderMetadataURL https://idp.mydomain/adfs/.well-known/openid-configuration
OIDCClientID {CLIENT_ID}
OIDCClientSecret {CLIENT_SECRET}
OIDCRedirectURI http://test.mydomain/protected/redirect_uri
OIDCCryptoPassphrase {PASSPHRASE}
OIDCJWKSRefreshInterval 3600
<Location "/protected/">
       AuthType openid-connect
       Require valid-user
</Location>
<Directory "/var/www/html">
        AuthType openid-connect
        Require valid-user
</Directory>

PHP Test Code in root folder to show headers :

<?php foreach ($_SERVER as $key=>$value) { echo "$key : $value</br>"; } ?>

I should have other claims, like : email,sn,givenname

Sample test :

OIDC_CLAIM_sub : +1UE3NqwxggdwggwdmeoM77h0i9ZO+JwsfjVx3TQY=
OIDC_CLAIM_aud : 55e56a76-6f83-4f12-bfa9-452120eb0c4f
OIDC_CLAIM_iss : https://idp.mydomain/adfs
OIDC_CLAIM_iat : 1733395231
OIDC_CLAIM_nbf : 1733395321
OIDC_CLAIM_exp : 1733399321
OIDC_CLAIM_auth_time : 1733389754
OIDC_CLAIM_nonce : _0ErVooXfj3LWMio4ijdgjUgkljdfwUhgjc2LbPuzwdgFSD_g
OIDC_CLAIM_upn : me@mydomain
OIDC_CLAIM_unique_name : mydomain\my_id
OIDC_CLAIM_pwd_exp : 6111668
OIDC_CLAIM_sid : S-1-5-21-334719049-2235157316-3456476534196-12141
OIDC_access_token : eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Imc1WlNYZHp5VFlTT3RNU3kySTZsc3Y3clpfWSIsImtpZCI6Imc1WlNYZHp5VFlTT3RNU3kySTZsc3Y3clpfWSJ9.eyJhdWQiOiJ1cm46bWljcm9zb2Z0OnVzZXJpbmZvIiwiaXNzIjoiaHR0cDovL2ZzLnRhcm4uZnIvYWRmcy9zZXJ2aWNlcy90cnVzdCIsImlhdCI6MTczMzM5NTc1OCwibmJmIjoxNzMzMzk1NzU4LCJleHAiOjE3MzMzOTkzNTgsImFwcHR5cGUiOiJDb25maWRlbnRpYWwiLCJhcHBpZCI6kjsdgthkkfjwLKGKGKgkugklwxgfkjgdwkjgGGVXCjhcxhjhV0aGVudGljYXRpb25tZXRob2Qvd2luZG93cyIsImF1dGhfdGltZSI6IjIwMjQtMTItMDVUMDk6MTE6MjMuNDczWiIsInZlciI6IjEuMCIsInNjcCI6Im9wZW5pZCIsInN1YiI6IisxVUUzTnF3Ym9iMHRocFh2MEVtZW9NNzdoMGk5Wk8rSndzZmpWeDNUUVk9In0.SC0WeaZiRH_QFeB9x_k6XZ25RC-dfJp3JgchFgP3ZkPqq2SH5neNzqrg9KhcbOz9VkauLiTIzgsk6JUnFv1I_FOrcORu28FtfkULvIQBZRxJfkK-gstu84k_1nohx8aG_RzBcbGD7OhaqRH_2GwqdzGL7hrEGU0NlHo8UuknbavrHj-0CZwEY5b-YG6LnQ2evI8If1kLlUmyfTgmLuYHPR-6r82yFZiwZNd6104tM0wKGjhFHfkjffkjfjgFGFGddreRytgk/hmh84W8l5SV5FPYvmeyzIqNUO3HKKgeUxZNYAfLsEuCfhQwrp615n8_mX0lQKNKR7SlvqO11v-TvGapNx0Ju0g824Lsy6CuKOun9cDsFQ1JIQ2DWJkwDYayUwVSL56T-nFk6b7ZeTHcgGwGvgu5bb4A6GnjbNvYCqCS8m-SotPyKtjX-BlnMvAqSYg_KUkgv0foqHtzUSRVkvzJuwtH0VYlVmBirAzkB5jbH1Usj8foDR0HHfB5yISDF7uTMxJX-h231RNuPynUPlmXKUGlkuulguGfgyfFFDtdtuihNlkLoutftutyTbgpaGqH59aDVlzm0J7mYtSuC5MJ9aMmWmDRYDU_7jYOVTEoU9CvCi7B-GnR9NPpi1tARxJaRSau6s-dRAqyDAA-FP7i_7otku8IGDxwTOcCu2KFNCEmo
OIDC_access_token_expires : 1733312458
HTTP_HOST : test.mydomain
HTTP_USER_AGENT : Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
HTTP_ACCEPT : text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
HTTP_ACCEPT_LANGUAGE : fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
HTTP_ACCEPT_ENCODING : gzip, deflate
HTTP_DNT : 1
HTTP_CONNECTION : keep-alive
HTTP_COOKIE : filemanager=9u3dfydyh0p1135gkf60r7e5gh; mod_auth_openidc_session=rfNNcgeOsFJyjZdjghhkfgk9FKDX4
HTTP_UPGRADE_INSECURE_REQUESTS : 1
HTTP_PRIORITY : u=0, i
PATH : /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
SERVER_SIGNATURE :
SERVER_SOFTWARE : Apache
SERVER_NAME : test.mydomain
SERVER_ADDR : IP
SERVER_PORT : 80
REMOTE_ADDR : IP
DOCUMENT_ROOT : /var/www/html
REQUEST_SCHEME : http
CONTEXT_PREFIX :
CONTEXT_DOCUMENT_ROOT : /var/www/html
SERVER_ADMIN : admin@mydomain
SCRIPT_FILENAME : /var/www/html/test.php
REMOTE_PORT : 1270
REMOTE_USER : my_id
AUTH_TYPE : openid-connect
GATEWAY_INTERFACE : CGI/1.1
SERVER_PROTOCOL : HTTP/1.1
REQUEST_METHOD : GET
QUERY_STRING :
REQUEST_URI : /test.php
SCRIPT_NAME : /test.php
PHP_SELF : /test.php
PHP_AUTH_USER : my_id
REQUEST_TIME_FLOAT : 1736595762.3366
REQUEST_TIME : 1738525762

[Ssshafi]

I answer to myself for those who will be in the same case....
ADFS 2016+ require response_mode as POST in order to send custom claims.
So I add :
OIDCResponseMode form_post
OIDCScope "openid allatclaims"
And all my custom claims are now in headers.

I had also a misconfiguration in ADFS, in the Web API Application, the Identifier should be the Client ID of the Application.