To map values from an OIDC JWT token in Ory using Jsonnet, you use the external variable claims, which contains all the data provided by the OIDC provider. In your Jsonnet data mapper, you access these claims using std.extVar('claims'). You can then map these values to your identity traits or metadata as needed. Here’s a basic example:

jsonnet local claims = std.extVar('claims');  {   identity: {     traits: {       // Map the email claim if it exists and is verified       [if 'email' in claims && claims.email_verified then 'email' else null]: claims.email,       // Map the user's name       [if 'name' in claims then 'name' else null]: claims.name,       // Map a custom claim from raw_claims       [if 'groups' in claims.raw_claims then 'groups' else null]: claims.raw_claims.groups,     },     // Optionally, store all claims for debugging     metadata_public: {       debug_claims: claims     }   } }

- The claims object contains all standard and custom claims from the OIDC JWT token. - Standard claims (like email, name, etc.) are accessed directly (e.g., claims.email). - Custom claims not part of the standard set are available under claims.raw_claims (e.g., claims.raw_claims.groups). - You can use conditional mapping to ensure only available claims are mapped, preventing errors if a claim is missing. For more details and examples, see the official documentation on [Jsonnet data mapping](https://www.ory.sh/docs/kratos/social-signin/data-mapping#write-a-jsonnet-data-mapper) and [reference for Jsonnet in Ory](https://www.ory.sh/docs/kratos/reference/jsonnet).

Based on the provided knowledge sources, it is not possible to map values outside of the claims object in the Jsonnet data mapper for Ory social sign-in and OIDC integrations. The Jsonnet data mapper receives its input exclusively via external variables, most notably

std.extVar('claims')

for OIDC, which contains all the data returned by the provider, including standard and custom claims. There is no mention in the documentation or issues of being able to access or map values from outside this claims object in the mapping process. All examples and references show mapping only from within the

claims

object or its subfields (such as

raw_claims

). If you need to map additional data, it must be included in the claims provided by the OIDC provider. There is no documented support for accessing other sources or context within the Jsonnet data mapper at this time [Data mapping with Jsonnet](https://www.ory.sh/docs/kratos/reference/jsonnet) [Write a Jsonnet data mapper](https://www.ory.sh/docs/kratos/social-signin/data-mapping#write-a-jsonnet-data-mapper). If you have a use case that requires mapping data outside of claims, you may need to look into custom flows or feature requests, but this is not supported in the standard Jsonnet mapping process.