Selective JWT Access Token Claims Handling

[shashimalcse]

Is your suggestion related to an experience ? Please describe.
In Identity Server/Asgardeo, The attributes configured in the user attributes section are automatically added to the JWT access token when those claims are requested. This automatic inclusion can lead to unnecessary claims within the JWT access token. This may result in the inclusion of personally identifiable information (PII) without any practical necessity, leading to the overexposure of sensitive user information. Also, these unwanted claims in JWT access token can increase the token's size, thereby impacting performance.

There is no existing mechanism to selectively include or exclude these user attributes to JWT access tokens.
To address this issue, we need to introduce a way to handle JWT access token claims selectively. This would allow admins to control which claims should be included in the JWT access token. Such a feature ensures that sensitive information is handled securely and only necessary data is transmitted through JWT access tokens.

Describe the improvement
Introduce selective JWT access token claims handling. This offer admins to control which claims should be included in the JWT access tokens.

Additional context