arbitrary claims are not being returned from assertion header

[desimone]

What happened?

Non-standard ("arbitrary") identity claims are not being added to the jwt-assertion header, although they are being added as custom headers.

What did you expect to happen?

Arbitrary / non-standard identity claims to be added to the assertion payload.

How'd it happen?

See config.

What's your environment like?

• Pomerium version (retrieve with pomerium --version): pomerium/pomerium@264cf38
• Server Operating System/Architecture/Cloud: Gsuite

What's your config.yaml?

jwt_claims_headers:
  X-Pomerium-Claim-Photo: picture

policy:
  - from: https://verify.localhost.pomerium.io
    to: http://localhost
    allowed_domains:
      - pomerium.com
      - gmail.com
    pass_identity_headers: true

What did you see in the logs?

https://verify.localhost.pomerium.io/json

Note: the custom header is working but not the jwt.

{
  "PomeriumHeaders": {
    "X-Pomerium-Claim-Photo": [
      "https://lh3.googleusercontent.com/a-/AOh14Gii_LGprpis2aE66KbBWWts7Sn6aJieLUvne_hK=s96-c"
    ]
  },
  "PomeriumInfo": {
    "iss": "authenticate.localhost.pomerium.io",
    "sub": "snip",
    "aud": [
      "verify.localhost.pomerium.io"
    ],
    "exp": 1620360056,
    "iat": 1620357554,
    "jti": "72734065-c0fa-40b1-ab15-b4830c741432",
    "groups": [
      "[email protected]",
    ],
    "user": "snip",
    "email": "[email protected]",
  },
  "PomeriumInfoErr": null,
  "Request": {
    "Host": "verify.localhost.pomerium.io",
    "Hostname": "bdds-MacBook-Air.local",
    "Method": "GET",
    "Origin": "192.168.1.63",
    "URL": "/json",
    "UUID": "8afcb51d-b5d2-93c1-44a5-8e83ef45b35d"
  }
}

Where as I would expect....

{
  "aud": "verify.localhost.pomerium.io",
  "email": "[email protected]",
  "exp": snip,
  "groups": [  ],
  "iat": 1620357554,
  "iss": "authenticate.localhost.pomerium.io",
  "jti": "72734065-c0fa-40b1-ab15-b4830c741432",
+  "picture": "https://lh3.googleusercontent.com/a-/AOh14Gii_LGprpis2aE66KbBWWts7Sn6aJieLUvne_hK=s96-c",
  "sub": "111432655977273150308",
  "user": "111432655977273150308"
}

Additional context

Add any other context about the problem here.