FerrisKey
← Modules

Scopes & Protocol Mappers

Aegis

Controls exactly what data flows into your tokens. Client scopes define named collections of claims; protocol mappers extract data from users and inject it into JWTs.

Read the docs All modules

Covers

JWT ClaimsCustom ScopesProtocol MappersOIDC Standard ScopesopenidemailprofileRole ClaimsCustom ClaimsToken Control

Key capabilities

What Aegis does for you.

  • 01

    Client Scopes

    Named collections of claims, assigned per client, so different apps get different token contents.

  • 02

    Protocol Mappers

    Rules that extract data from the user and inject it as JWT claims. Map roles, attributes, or hardcoded values.

  • 03

    Standard OIDC

    Ships with openid, profile, email, roles, address, phone, and offline_access seeded into every realm.

  • 04

    Default vs Optional

    Default scopes are always included. Optional scopes are only included when the client explicitly requests them.

  • 05

    Custom Claims

    Add business-specific claims (department, plan tier, feature flags) through custom protocol mapper rules.

  • 06

    Minimal Exposure

    Public mobile apps get sub and email. Internal admin tools get realm_roles. Fine-grained data minimization.

How it works

From the first request to the result, in 4 steps.

  1. 1

    Client requests scopes

    During authentication, the client specifies which scopes it needs (e.g., openid email profile).

  2. 2

    Scopes resolved

    Aegis looks up the client's default scopes and merges in any requested optional scopes.

  3. 3

    Mappers executed

    Each protocol mapper in the resolved scopes runs, reading the user object and producing claims.

  4. 4

    Claims assembled

    All claims are merged into the final JWT payload and signed. Only the requested data is included.

Ready to use Aegis?

Full reference, configuration options, and examples in the documentation.

Open docs

Other modules