{"version":"2.1.312","anchor":"oidc-proxy-gains-oidcuser-id-claim","canonical_anchor":"oidc-proxy-gains-oidcuser-id-claim","heading":"The OIDC gateway can take the user ID from a claim other than sub","tier":"use","area":"Gateway","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312\/e\/oidc-proxy-gains-oidcuser-id-claim","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312","markdown":"### The OIDC gateway can take the user ID from a claim other than `sub`\n\nA new `oidc.user_id_claim` setting picks which sign-in token field holds the user ID, defaulting to `sub`\n\n**Unclear.** Whether tokens must still include a `sub` claim when `oidc.user_id_claim` names a different one is not settled.\n\n**What**\n\nOIDC is a standard way of signing users in, and the sign-in token it produces carries fields called claims. Claude Code's gateway used to take the user ID straight from the `sub` claim. It now reads it from the claim named in the new `oidc.user_id_claim` setting, and uses `sub` when that setting is not given.\n\nIf the named claim is missing from a token, the gateway stops with an error coded `USER_ID_CLAIM_MISSING`.\n\n**Why**\n\nOperators can now identify users by a field other than `sub`, which helps when their sign-in provider puts the useful ID somewhere else.\n\n- Area: Gateway\n- Names: `oidc.user_id_claim`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: no"}