This value has little downstream relevance, and applications potentially use this value for mapping to users in systems which obviously won't know this opaque value. Telling applications to use a different attribute we include in the JWT can be a tough sell (and sometimes has technical limitations) and makes us look bad.

If implemented, you should be able to set the 'sub' JWT attribute to an attribute of your choosing on a 'per client' basis. So one client may use CN as the sub, another might use email, for example.

by: Daniel B. | over a year ago | Other