Repository: authelia/authelia (go)

Issue:
Can not use "http://example.com/myclaim" as the name for a custom claim
### Version


v4.39.4

### Deployment Method


Bare-metal

### Reverse Proxy


NGINX

### Reverse Proxy Version


1.28.0

### Description


Our company uses a third-party application that recently introduced OAuth 2.0 authentication support. During configuration, we need to create a custom claim named "http://example.com/myclaim". However, when we attempt to configure this custom claim in Authelia using the full URL as the claim name, Authelia fails to start. While changing the claim name to something simpler like "myclaim" allows Authelia to start successfully, the third-party application specifically requires the URL format for the claim name and this requirement cannot be modified on their end.

I have also attempted several different methods to escape the special characters within the URL, but none of these approaches have been successful.

### Reproduction


Add the following configuration to Authelia's config file:

```yaml
identity_providers:
  oidc:
    claims_policies:
      3rdparty_policy:
        custom_claims:
          "http://example.com/myclaim":
            attribute: 'ioadmin'
    clients:
      - client_id: '3rdparty'
        client_secret: ''
        public: true
        authorization_policy: 'one_factor'
        consent_mode: 'implicit'
        redirect_uris:
          - 'http://localhost:42420/3rdparty.UIL.Shell'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        token_endpoint_auth_method: 'none'
        claims_policy: '3rdparty_policy'
        audience:
          - 'https://example.com/api'
```

When Authelia attempts to start with this configuration, it fails due to the URL format used in the custom claim name "http://example.com/myclaim". The issue specifically occurs when using a full URL (including the protocol and domain) as the claim identifier.

This format is required by our third-party application and cannot be changed to a simpler claim name like "myclaim", which would otherwise allow Authelia to start successfully.

### Expectations


I expect to be able to use "http://example.com/myclaim" as a custom claim name.

### Configuration (Authelia)


```yaml

```

### Build Information


```shell
Last Tag: v4.39.4
State: tagged clean
Branch: v4.39.4
Commit: 3f173e1cd1acda592dcb4aa161f43823d6df1110
Build Number: AUR
Build OS: linux
Build Arch: amd64
Build Compiler: gc
Build Date: Thu, 19 Jun 2025 08:38:11 +0200
Extra: 

Go:
    Version: go1.24.3
    Module Path: 
    Executable Path: command-line-arguments
```

### Logs (Authelia)


```shell
Started Authelia authentication and authorization server.
time="2025-06-19T14:02:22+02:00" level=debug msg="Loaded Configuration Sources" files="[/etc/authelia/configuration.yml]" filters="[]"
time="2025-06-19T14:02:22+02:00" level=debug msg="Logging Initialized" fields.level=debug file= format= keep_stdout=false
time="2025-06-19T14:02:22+02:00" level=debug msg="Process user information" gid=957 gids=958 name="Authelia Daemon User" uid=957 username=authelia
time="2025-06-19T14:02:22+02:00" level=error msg="Configuration: configuration key not expected: identity_providers.oidc.claims_policies.justenough_policy.custom_claims.http://example.com/myclaim.attribute" stack="github.com/authelia/authelia/v4/internal/commands/context.go:189 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/cobra@v1.9.1/command.go:1000                    (*Command).execute\ngithub.com/spf13/cobra@v1.9.1/command.go:1148                    (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.9.1/command.go:1071                    (*Command).Execute\n./main.go:10                                                     main\ninternal/runtime/atomic/types.go:194                             (*Uint32).Load\nruntime/asm_amd64.s:1700                                         goexit"
time="2025-06-19T14:02:22+02:00" level=error msg="Configuration: identity_providers: oidc: claims_policies: justenough_policy: claim with name 'http://example' has an attribute name 'http://example' which is not a known attribute" stack="github.com/authelia/authelia/v4/internal/commands/context.go:189 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/cobra@v1.9.1/command.go:1000                    (*Command).execute\ngithub.com/spf13/cobra@v1.9.1/command.go:1148                    (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.9.1/command.go:1071                    (*Command).Execute\n./main.go:10                                                     main\ninternal/runtime/atomic/types.go:194                             (*Uint32).Load\nruntime/asm_amd64.s:1700                                         goexit"
time="2025-06-19T14:02:22+02:00" level=fatal msg="Can't continue due to the errors loading the configuration" stack="github.com/authelia/authelia/v4/internal/commands/context.go:189 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/cobra@v1.9.1/command.go:1000                    (*Command).execute\ngithub.com/spf13/cobra@v1.9.1/command.go:1148                    (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.9.1/command.go:1071                    (*Command).Execute\n./main.go:10                                                     main\ninternal/runtime/atomic/types.go:194                             (*Uint32).Load\nruntime/asm_amd64.s:1700                                         goexit"
authelia.service: Main process exited, code=exited, status=1/FAILURE
authelia.service: Failed with result 'exit-code'.
```

### Logs (Proxy / Application)


```shell

```

### Documentation


_No response_

### Generative AI


No

### Pre-Submission Checklist


- [x] I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)

- [x] This is a bug report and not a support request

- [x] I have read the security policy and this bug report is not a security issue or security related issue

- [x] I have either included the complete configuration file or I am sure it's unrelated to the configuration

- [x] I have either included the complete debug / trace logs or the output of the build-info command if the logs are not relevant

- [x] I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide

- [x] I have checked for related proxy or application logs and included them if available

- [x] I have checked for related issues and checked the documentation


Pull request description:
fix(configuration): allow claim name override
This fixes an issue where certain custom claim names can't be specified by introducing an explicit configuration key that defines it.

Fixes #9687

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
  * Added support for specifying a custom name for each OpenID Connect custom claim, allowing explicit control over claim naming in configuration.

* **Documentation**
  * Updated documentation to clarify how custom claim names and attributes are determined, including the new optional claim name field.

* **Bug Fixes**
  * Improved validation to ensure claim names are unique within a policy and that reserved claim names are properly checked.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Patch:
diff --git a/docs/content/configuration/identity-providers/openid-connect/provider.md b/docs/content/configuration/identity-providers/openid-connect/provider.md
index f93937e9a..05dd84f78 100644
--- a/docs/content/configuration/identity-providers/openid-connect/provider.md
+++ b/docs/content/configuration/identity-providers/openid-connect/provider.md
@@ -100,6 +100,7 @@ identity_providers:
         id_token_audience_mode: 'specification'
         custom_claims:
           claim_name:
+            name: 'claim_name'
             attribute: 'attribute_name'
     scopes:
       scope_name:
@@ -647,13 +648,19 @@ The list of claims available in this policy in addition to the standard claims.
 which can either be concrete attributes from the [first factor](../../first-factor/introduction.md) backend or can be
 those defined via [definitions](../../definitions/user-attributes.md).
 
-The keys under `custom_claims` are arbitrary values which are the names of the claims.
+The keys under `custom_claims` are arbitrary values, and by default are the claim name and attribute values.
+
+##### name
+
+{{< confkey type="string" required="no" >}}
+
+The claim name for this claim. By default it's the same as the dictionary key.
 
 ##### attribute
 
 {{< confkey type="string" required="no" >}}
 
-The attribute name that this claim returns. By default it's the same as the claim name.
+The attribute name that this claim returns. By default it's the same as the dictionary key.
 
 ### scopes
 
diff --git a/docs/static/schemas/v4.39/json-schema/configuration.json b/docs/static/schemas/v4.39/json-schema/configuration.json
index c586769a5..745286260 100644
--- a/docs/static/schemas/v4.39/json-schema/configuration.json
+++ b/docs/static/schemas/v4.39/json-schema/configuration.json
@@ -1484,12 +1484,7 @@
           "default": "specification"
         },
         "custom_claims": {
-          "patternProperties": {
-            ".*": {
-              "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaim"
-            }
-          },
-          "type": "object",
+          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaims",
           "title": "Custom Claims",
           "description": "The custom claims available in this policy in addition to the Standard Claims."
         }
@@ -2299,6 +2294,11 @@
     },
     "IdentityProvidersOpenIDConnectCustomClaim": {
       "properties": {
+        "name": {
+          "type": "string",
+          "title": "Name",
+          "description": "The name of claim."
+        },
         "attribute": {
           "type": "string",
           "title": "Attribute",
@@ -2308,6 +2308,14 @@
       "additionalProperties": false,
       "type": "object"
     },
+    "IdentityProvidersOpenIDConnectCustomClaims": {
+      "patternProperties": {
+        ".*": {
+          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaim"
+        }
+      },
+      "type": "object"
+    },
     "IdentityProvidersOpenIDConnectLifespan": {
       "properties": {
         "access_token": {
diff --git a/internal/configuration/schema/identity_providers.go b/internal/configuration/schema/identity_providers.go
index e5884b9b5..78cff8c4f 100644
--- a/internal/configuration/schema/identity_providers.go
+++ b/internal/configuration/schema/identity_providers.go
@@ -51,10 +51,23 @@ type IdentityProvidersOpenIDConnectClaimsPolicy struct {
 
 	IDTokenAudienceMode string `koanf:"id_token_audience_mode" yaml:"id_token_audience_mode,omitempty" toml:"id_token_audience_mode,omitempty" json:"id_token_audience_mode,omitempty" jsonschema:"default=specification,title=ID Token Audience Mode,enum=specification,enum=experimental-merged" jsonschema_description:"Sets the mode for ID Token audience derivation for clients that use this policy."`
 
-	CustomClaims map[string]IdentityProvidersOpenIDConnectCustomClaim `koanf:"custom_claims" yaml:"custom_claims,omitempty" toml:"custom_claims,omitempty" json:"custom_claims,omitempty" jsonschema:"title=Custom Claims" jsonschema_description:"The custom claims available in this policy in addition to the Standard Claims."`
+	CustomClaims IdentityProvidersOpenIDConnectCustomClaims `koanf:"custom_claims" yaml:"custom_claims,omitempty" toml:"custom_claims,omitempty" json:"custom_claims,omitempty" jsonschema:"title=Custom Claims" jsonschema_description:"The custom claims available in this policy in addition to the Standard Claims."`
+}
+
+type IdentityProvidersOpenIDConnectCustomClaims map[string]IdentityProvidersOpenIDConnectCustomClaim
+
+func (c IdentityProvidersOpenIDConnectCustomClaims) GetCustomClaimByName(name string) IdentityProvidersOpenIDConnectCustomClaim {
+	for _, properties := range c {
+		if properties.Name == name {
+			return properties
+		}
+	}
+
+	return IdentityProvidersOpenIDConnectCustomClaim{}
 }
 
 type IdentityProvidersOpenIDConnectCustomClaim struct {
+	Name      string `koanf:"name" yaml:"name" toml:"name,omitempty" json:"name,omitempty" jsonschema:"title=Name" jsonschema_description:"The name of claim."`
 	Attribute string `koanf:"attribute" yaml:"attribute,omitempty" toml:"attribute,omitempty" json:"attribute,omitempty" jsonschema:"title=Attribute" jsonschema_description:"The attribute that populates this claim."`
 }
 
diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go
index e6c8bde3f..5329de9aa 100644
--- a/internal/configuration/schema/keys.go
+++ b/internal/configuration/schema/keys.go
@@ -143,6 +143,7 @@ var Keys = []string{
 	"identity_providers.oidc.claims_policies.*.custom_claims",
 	"identity_providers.oidc.claims_policies.*.custom_claims.*",
 	"identity_providers.oidc.claims_policies.*.custom_claims.*.attribute",
+	"identity_providers.oidc.claims_policies.*.custom_claims.*.name",
 	"identity_providers.oidc.claims_policies.*.id_token",
 	"identity_providers.oidc.claims_policies.*.id_token_audience_mode",
 	"identity_providers.oidc.clients",
diff --git a/internal/configuration/validator/identity_providers.go b/internal/configuration/validator/identity_providers.go
index 92231ba93..3be64a058 100644
--- a/internal/configuration/validator/identity_providers.go
+++ b/internal/configuration/validator/identity_providers.go
@@ -143,26 +143,39 @@ func validateOIDCClaims(config *schema.Configuration, validator *schema.StructVa
 	for name, policy := range config.IdentityProviders.OIDC.ClaimsPolicies {
 		var claims []string
 
-		for claim, properties := range policy.CustomClaims {
-			if utils.IsStringInSlice(claim, validOIDCReservedClaims) {
-				validator.Push(fmt.Errorf("identity_providers: oidc: claims_policies: %s: custom_claims: claim with name '%s' can't be used in a claims policy as it's a standard claim", name, claim))
+		seen := make(map[string]string, len(policy.CustomClaims))
+
+		for key, properties := range policy.CustomClaims {
+			if properties.Name == "" {
+				properties.Name = key
+				policy.CustomClaims[key] = properties
 			}
 
-			if !utils.IsStringInSlice(claim, claims) {
-				claims = append(claims, claim)
+			if properties.Attribute == "" {
+				properties.Attribute = key
+				policy.CustomClaims[key] = properties
 			}
 
-			if !utils.IsStringInSlice(claim, config.IdentityProviders.OIDC.Discovery.Claims) {
-				config.IdentityProviders.OIDC.Discovery.Claims = append(config.IdentityProviders.OIDC.Discovery.Claims, claim)
+			if utils.IsStringInSlice(properties.Name, validOIDCReservedClaims) {
+				validator.Push(fmt.Errorf("identity_providers: oidc: claims_policies: %s: custom_claims: claim with name '%s' can't be used in a claims policy as it's a standard claim", name, properties.Name))
 			}
 
-			if properties.Attribute == "" {
-				properties.Attribute = claim
-				policy.CustomClaims[claim] = properties
+			if !utils.IsStringInSlice(properties.Name, claims) {
+				claims = append(claims, properties.Name)
+			}
+
+			if !utils.IsStringInSlice(properties.Name, config.IdentityProviders.OIDC.Discovery.Claims) {
+				config.IdentityProviders.OIDC.Discovery.Claims = append(config.IdentityProviders.OIDC.Discovery.Claims, properties.Name)
+			}
+
+			if k, ok := seen[properties.Name]; ok {
+				validator.Push(fmt.Errorf("identity_providers: oidc: claims_policies: %s: custom_claims: claim with name '%s' is mapped in both '%s' and the '%s' claim configurations", name, properties.Name, key, k))
+			} else {
+				seen[properties.Name] = key
 			}
 
 			if !isUserAttributeValid(properties.Attribute, config) {
-				validator.Push(fmt.Errorf("identity_providers: oidc: claims_policies: %s: claim with name '%s' has an attribute name '%s' which is not a known attribute", name, claim, properties.Attribute))
+				validator.Push(fmt.Errorf("identity_providers: oidc: claims_policies: %s: claim with name '%s' has an attribute name '%s' which is not a known attribute", name, properties.Name, properties.Attribute))
 			}
 		}
 
@@ -991,7 +1004,7 @@ func validateOIDCClientScopes(c int, config *schema.IdentityProvidersOpenIDConne
 				continue
 			}
 
-			if _, ok = claims.CustomClaims[claim]; !ok {
+			if mapping := claims.CustomClaims.GetCustomClaimByName(claim); mapping.Name == "" {
 				validator.Push(fmt.Errorf("identity_providers: oidc: clients: client '%s': option 'scopes' contains value '%s' which requires claim '%s' but the claim is not a claim provided by 'claims_policy' with the name '%s' or a standard claim", config.Clients[c].ID, scope, claim, config.Clients[c].ClaimsPolicy))
 			}
 		}
diff --git a/internal/oidc/claims.go b/internal/oidc/claims.go
index 44b3aa67a..d68685b09 100644
--- a/internal/oidc/claims.go
+++ b/internal/oidc/claims.go
@@ -439,6 +439,8 @@ func NewDefaultCustomClaimsStrategy() (strategy *CustomClaimsStrategy) {
 
 // NewCustomClaimsStrategy creates a *CustomClaimsStrategy given a policy name, list of allowed scopes, the scope map,
 // and the policy map.
+//
+//nolint:gocyclo
 func NewCustomClaimsStrategy(policyName string, scopes []string, scopeMap map[string]schema.IdentityProvidersOpenIDConnectScope, policyMap map[string]schema.IdentityProvidersOpenIDConnectClaimsPolicy) (strategy *CustomClaimsStrategy) {
 	strategy = NewDefaultCustomClaimsStrategy()
 
@@ -448,8 +450,8 @@ func NewCustomClaimsStrategy(policyName string, scopes []string, scopeMap map[st
 
 	var (
 		policy  schema.IdentityProvidersOpenIDConnectClaimsPolicy
-		mapping schema.IdentityProvidersOpenIDConnectScope
 		claim   schema.IdentityProvidersOpenIDConnectCustomClaim
+		mapping schema.IdentityProvidersOpenIDConnectScope
 
 		ok   bool
 		name string
@@ -491,12 +493,10 @@ func NewCustomClaimsStrategy(policyName string, scopes []string, scopeMap map[st
 			case ClaimPhoneNumber:
 				strategy.scopes[scope][name] = expression.AttributeUserPhoneNumberRFC3966
 			default:
-				claim = policy.CustomClaims[name]
-
-				if claim.Attribute == "" {
-					strategy.scopes[scope][name] = name
-				} else {
+				if claim = policy.CustomClaims.GetCustomClaimByName(name); claim.Name != "" || claim.Attribute != "" {
 					strategy.scopes[scope][name] = claim.Attribute
+				} else {
+					strategy.scopes[scope][name] = name
 				}
 			}
 		}


Test patch:
diff --git a/docs/static/schemas/latest/json-schema/configuration.json b/docs/static/schemas/latest/json-schema/configuration.json
index c586769a5..745286260 100644
--- a/docs/static/schemas/latest/json-schema/configuration.json
+++ b/docs/static/schemas/latest/json-schema/configuration.json
@@ -1484,12 +1484,7 @@
           "default": "specification"
         },
         "custom_claims": {
-          "patternProperties": {
-            ".*": {
-              "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaim"
-            }
-          },
-          "type": "object",
+          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaims",
           "title": "Custom Claims",
           "description": "The custom claims available in this policy in addition to the Standard Claims."
         }
@@ -2299,6 +2294,11 @@
     },
     "IdentityProvidersOpenIDConnectCustomClaim": {
       "properties": {
+        "name": {
+          "type": "string",
+          "title": "Name",
+          "description": "The name of claim."
+        },
         "attribute": {
           "type": "string",
           "title": "Attribute",
@@ -2308,6 +2308,14 @@
       "additionalProperties": false,
       "type": "object"
     },
+    "IdentityProvidersOpenIDConnectCustomClaims": {
+      "patternProperties": {
+        ".*": {
+          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaim"
+        }
+      },
+      "type": "object"
+    },
     "IdentityProvidersOpenIDConnectLifespan": {
       "properties": {
         "access_token": {
diff --git a/internal/configuration/test_resources/config_oidc_claims.yml b/internal/configuration/test_resources/config_oidc_claims.yml
index f5fb2ea1b..3760189eb 100644
--- a/internal/configuration/test_resources/config_oidc_claims.yml
+++ b/internal/configuration/test_resources/config_oidc_claims.yml
@@ -131,6 +131,8 @@ definitions:
   user_attributes:
     authelia_admin:
       expression: '"admin" in groups'
+    ioadmin:
+      expression: '"ioadmin" in groups'
 
 identity_providers:
   oidc:
@@ -265,12 +267,36 @@ identity_providers:
       allowed_origins:
         - 'https://google.com'
         - 'https://example.com'
+    scopes:
+      example_scope:
+        claims:
+          - 'http://example.com/myclaim'
     claims_policies:
       default:
         custom_claims:
           authelia_admin: {}
+      example_policy:
+        custom_claims:
+          example:
+            name: 'http://example.com/myclaim'
+            attribute: 'ioadmin'
     clients:
       - client_id: 'abc'
         client_secret: '123'
         consent_mode: 'explicit'
+      - client_id: 'example_client'
+        client_secret: ''
+        public: true
+        authorization_policy: 'one_factor'
+        consent_mode: 'implicit'
+        redirect_uris:
+          - 'http://localhost:42420/3rdparty.UIL.Shell'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'groups'
+          - 'email'
+          - 'example_scope'
+        token_endpoint_auth_method: 'none'
+        claims_policy: 'example_policy'
 ...
diff --git a/internal/configuration/validator/identity_providers_test.go b/internal/configuration/validator/identity_providers_test.go
index 84ce4f631..718734b94 100644
--- a/internal/configuration/validator/identity_providers_test.go
+++ b/internal/configuration/validator/identity_providers_test.go
@@ -4509,6 +4509,7 @@ func TestShouldValidateOpenIDConnectClaimsPolicies(t *testing.T) {
 	testCases := []struct {
 		name    string
 		have    *schema.Configuration
+		scopes  bool
 		expectf func(t *testing.T, actual *schema.IdentityProvidersOpenIDConnect)
 		errors  []string
 	}{
@@ -4630,6 +4631,42 @@ func TestShouldValidateOpenIDConnectClaimsPolicies(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "ShouldAllowCustomClaimsNameMapping",
+			have: &schema.Configuration{
+				AuthenticationBackend: schema.AuthenticationBackend{
+					File: &schema.AuthenticationBackendFile{},
+				},
+				IdentityProviders: schema.IdentityProviders{
+					OIDC: &schema.IdentityProvidersOpenIDConnect{
+						Scopes: map[string]schema.IdentityProvidersOpenIDConnectScope{
+							"example": {
+								Claims: []string{"http://example.com/myclaim"},
+							},
+						},
+						ClaimsPolicies: map[string]schema.IdentityProvidersOpenIDConnectClaimsPolicy{
+							"example": {
+								IDToken:     []string{"id-claim"},
+								AccessToken: []string{"at-claim"},
+								CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
+									"id-claim": {Attribute: "email"},
+									"at-claim": {Attribute: "email"},
+									"myclaim":  {Name: "http://example.com/myclaim", Attribute: "email"},
+								},
+							},
+						},
+						Clients: []schema.IdentityProvidersOpenIDConnectClient{
+							{
+								ID:           "example",
+								Scopes:       []string{"openid", "example"},
+								ClaimsPolicy: "example",
+							},
+						},
+					},
+				},
+			},
+			scopes: true,
+		},
 		{
 			name: "ShouldNotAllowCustomClaimsAutoMissingAttribute",
 			have: &schema.Configuration{
@@ -4925,6 +4962,14 @@ func TestShouldValidateOpenIDConnectClaimsPolicies(t *testing.T) {
 
 			validateOIDCClaims(tc.have, val)
 
+			if tc.scopes {
+				require.Len(t, tc.have.IdentityProviders.OIDC.Clients, 1)
+
+				validateOIDCClientScopes(0, tc.have.IdentityProviders.OIDC, val, false, func() {
+
+				})
+			}
+
 			if tc.expectf != nil {
 				tc.expectf(t, tc.have.IdentityProviders.OIDC)
 			}
diff --git a/internal/oidc/claims_test.go b/internal/oidc/claims_test.go
index 174f7cf74..1883c1124 100644
--- a/internal/oidc/claims_test.go
+++ b/internal/oidc/claims_test.go
@@ -236,6 +236,7 @@ func TestNewClaimRequestsMatcher(t *testing.T) {
 			policy: {
 				CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 					claim: {
+						Name:      claim,
 						Attribute: attribute,
 					},
 				},
@@ -813,6 +814,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -863,6 +865,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -916,6 +919,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -969,6 +973,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1022,6 +1027,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1075,6 +1081,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1125,6 +1132,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1175,6 +1183,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1228,9 +1237,11 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 							"example-claim-alt": {
+								Name:      "example-claim-alt",
 								Attribute: "example-claim",
 							},
 						},
@@ -1281,6 +1292,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1331,6 +1343,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1378,6 +1391,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},
@@ -1428,6 +1442,7 @@ func TestNewCustomClaimsStrategy(t *testing.T) {
 						AccessToken: []string{},
 						CustomClaims: map[string]schema.IdentityProvidersOpenIDConnectCustomClaim{
 							"example-claim": {
+								Name:      "example-claim",
 								Attribute: "example-claim",
 							},
 						},