So I am not sure what pangolin really needs here, but I did some more testing and the mentioned claims are all included in the JWT in my tests already in the currently released Cloudron OIDC server.
How did you see that those aren't included in your case as you mentioned? Are you even getting a valid JWT and can you decode that? How does that json object look after that?
The token response should look something like:
{
"access_token": "OGpFA1siYNbAQiCahuvjUDkKgoRAi4cz00lysJC6jt9",
"expires_in": 3600,
"id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjFrRF..........",
"refresh_token": "IJpU-ULmWoEYmUJmd55HLQF7aVHPbZIzdmWHUYQ1vB0",
"scope": "openid profile email",
"token_type": "Bearer"
}
Which then decoded in my case holds:
Payload (Claims)
sub:
"nebulon"
family_name:
""
given_name:
"Firstname"
locale:
"de-DE"
name:
"Lastname"
preferred_username:
"nebulon"
picture:
"https://my.cloudron/api/v1/profile/avatar/uid-e6e4afd0-f677-45e3-8d61-4dd039c32a11.png"
email:
"nebulon@..."
email_verified:
true
aud:
"cid-b901ffe1294a0683aff450bb86d036b5"
exp:
1765189670 (8.12.2025, 11:27:50)
iat:
1765186070 (8.12.2025, 10:27:50)
iss:
"https://my.cloudron..../openid"
