src/main/java/se/su/dsv/oauth2/shibboleth/ShibbolethTokenPopulator.java

@@ -40,19 +40,15 @@ public final class ShibbolethTokenPopulator implements OAuth2TokenCustomizer<Jwt
     @Override
     public void customize(final JwtEncodingContext context) {
         if (OAuth2TokenType.ACCESS_TOKEN.equals(context.getTokenType())) {
-            List<String> entitlements = context
+            List<String> entitlements = getEntitlements(context);
-                    .getPrincipal()
-                    .getAuthorities()
-                    .stream()
-                    .filter(Entitlement.class::isInstance)
-                    .map(Entitlement.class::cast)
-                    .map(Entitlement::entitlement)
-                    .toList();
 
             context.getClaims().claim("entitlements", entitlements);
         }
 
         if (OidcParameterNames.ID_TOKEN.equals(context.getTokenType().getValue())) {
+            List<String> entitlements = getEntitlements(context);
+            context.getClaims().claim("entitlements", entitlements);
+
             if (context.getPrincipal().getDetails() instanceof ShibbolethAuthenticationDetails details) {
                 OidcUserInfo oidcUserInfo = getOidcUserInfo(details);
 
@@ -67,6 +63,17 @@ public final class ShibbolethTokenPopulator implements OAuth2TokenCustomizer<Jwt
         }
     }
 
+    private static List<String> getEntitlements(JwtEncodingContext context) {
+        return context
+                .getPrincipal()
+                .getAuthorities()
+                .stream()
+                .filter(Entitlement.class::isInstance)
+                .map(Entitlement.class::cast)
+                .map(Entitlement::entitlement)
+                .toList();
+    }
+
     private Set<String> getAuthorizedClaims(final Set<String> scopes) {
         Set<String> authorizedClaims = new HashSet<>();
         if (scopes.contains(OidcScopes.PROFILE)) {

src/test/java/se/su/dsv/oauth2/IdTokenTest.java

@@ -6,6 +6,8 @@ import org.springframework.security.oauth2.core.oidc.OidcScopes;
 import org.springframework.security.oauth2.core.oidc.StandardClaimNames;
 import org.springframework.test.context.ActiveProfiles;
 
+import java.util.List;
+
 import static org.junit.jupiter.api.Assertions.*;
 import static se.su.dsv.oauth2.ShibbolethRequestProcessor.remoteUser;
 
@@ -108,4 +110,21 @@ public class IdTokenTest extends AbstractMetadataCodeFlowTest {
         assertNotNull(claimsSet.getClaim(StandardClaimNames.EMAIL_VERIFIED));
     }
 
+    @Test
+    public void includes_entitlements_in_the_id_token() throws Exception {
+        TokenResponse tokenResponse = authorize(request -> request
+                .queryParam("scope", OidcScopes.OPENID)
+                .with(remoteUser("someone@university")
+                        .entitlement("gdpr")
+                        .entitlement("hr")));
+
+        String idToken = tokenResponse.idToken();
+        assertNotNull(idToken);
+
+        JWTClaimsSet claimsSet = verifyToken(idToken);
+        List<String> entitlements = claimsSet.getStringListClaim("entitlements");
+        assertTrue(entitlements.contains("gdpr"));
+        assertTrue(entitlements.contains("hr"));
+    }
+
 }