preferred_
Registry Context
preferred_username is the End-User's preferred shorthand name at the relying party. It can contain any valid JSON string characters and must not be treated as unique.
Technical Summary
The preferred_username claim is a string-valued OpenID Connect Standard Claim. Its value MAY be any valid JSON string, including special characters. Relying Parties MUST NOT rely on it as unique or use it as a stable unique End-User identifier.
When Used
Used in OpenID Connect ID Token or UserInfo responses when an End-User's preferred shorthand name is requested or returned.
Normative Requirements
Unspecified actor
openid-connect-core-1_0 - Section 5.7
use preferred_username as a unique identifier for the End-User.
Condition: whether obtained from the ID Token or the UserInfo Endpoint
Therefore, other Claims such as email, phone_number, preferred_username, and name MUST NOT be used as unique identifiers for the End-User, whether obtained from the ID Token or the UserInfo Endpoint.
preferred_username claim value
openid-connect-core-1_0 - Section 5.1
be any valid JSON string, including special characters such as @, /, or whitespace.
This value MAY be any valid JSON string including special characters such as @, /, or whitespace.
RP
openid-connect-core-1_0 - Section 5.1
rely upon the preferred_username value being unique.
The RP MUST NOT rely upon this value being unique, as discussed in .
Validation Guidance
Accept preferred_username only as a JSON string value; do not reject solely because it contains characters such as @, /, or whitespace.
Do not enforce uniqueness constraints or identity matching logic based on preferred_username.
Security Notes
openid-connect-core-1_0 - Section 5.7
preferred_username is not a stable or unique identifier; use iss and sub together for unique End-User identification instead.
Reference
Details
- Entry Id
preferred_username - Claim Name
preferred_username - Claim Description
Shorthand name by which the End-User wishes to be referred to- Change Controller
OpenID_Foundation_ Artifact_ Binding_ Working_ Group - Reference
OpenID Connect Core 1.0 - Section 5.1