OIDC: Standard identifier and attributes

Providing attributes to applications follow the principle of "as few as possible, as many as necessary". So, for eIAM standard integrations as a specialist applications (federal office applications), you will get the identifier and attributes described below.

If your specialist application requires a different identifier, or additional attributes not listed here, then please address this and list your needs in the eIAM dossier.

Identifier

In the eIAM standard integration, the JWT (token) that is sent to the application contains the following attribute sub:

Sub content taken from attribute	Attribute format	Description
http://schemas.eiam.admin.ch/ws/2013/12/ identity/claims/e-id/userExtId	urn:oasis:names:tc:SAML:2.0: nameid-format:persistent	The userExtId of the Access Client. This value is unique, unchangeable and is used as part of standard integrations with Access Management.
http://schemas.xmlsoap.org/ws/2005/05/ identity/claims/name	urn:oasis:names:tc:SAML:2.0: nameid-format:persistent	The loginId of the root client. This value is unique, unchangeable and is used in the context of standard integrations without Access Management (Authentication Only).

Identifier and Standard attribute set

For the standard attribute set, the following rules apply:

All attributes are sourced from the root client unless noted otherwise. This ensures that the provided data is in compliance with the reported QoA level of the authentication.
All attributes provided are from eIAM are taken from eIAM attributes (originalIssuer="uri:eiam.admin.ch:feds"), no attributes from IdP will be provided.

List of attributes provided in the standard attribute set as at September 2026:

Content	Example	Attribute Name	Comment
Value of Subject NameID	123456789	sub	Standard OIDC attribute. Contains the agreed identifier of the user. For specialist applications this is the userExtId of the user in the access client.
Quality of authentication / identity verification	urn:qoa.eiam.admin.ch: names:tc:ac:classes:30	acr	Standard OIDC attribute. Contains the quality of authentication: OIDC QoA Specification
Display Name	Smith John FOITT	name	Standard OIDC attribute. Must only be used to display the user and must not be interpreted. In enterprise context this attribute has the format "last name & first name & OE". In eGov context this attribute has the format "last name & first name".
First name	John	given_name	Standard OIDC attribute.
Last name	Smith	family_name	Standard OIDC attribute.
Email address	john.smith@bit.admin.ch	email	Standard OIDC attribute.
Language	DE	language	Private claim name
Roles in current profile of current specialist application *	FOPH-emweb.ALLOW FOPH-embeb.Admin	roles	Standard OAuth2 for jwt All the roles the user has in the currently selected profile (multi-valued). If the user has multiple profiles the user has to choose a profile he wants to work with before.

*Not available with the Authenication Only integration pattern.

In addition to the Public Claims and Custom Claims mentioned above, the token also includes the Registered Claims ‘aud’, ‘azp’, ‘exp’, ‘nbf’, ‘iat’, ‘iss’ and ‘nonce’ as standard. These claims serve to secure the federation between eIAM and the relying party.