---
title: Configuring access token attributes for superuser scope in PingFederate
description: A resource might require that the access token contains the scope superuser. Configure the superuser scope in PingFederate.
component: pingaccess
version: 9.1
page_id: pingaccess:pingaccess_user_interface_reference_guide:pa_configuring_access_token_attributes_for_superuser_scope_in_pf
canonical_url: https://docs.pingidentity.com/pingaccess/9.1/pingaccess_user_interface_reference_guide/pa_configuring_access_token_attributes_for_superuser_scope_in_pf.html
llms_txt: https://docs.pingidentity.com/pingaccess/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: February 6, 2023
section_ids:
  steps: Steps
---

# Configuring access token attributes for superuser scope in PingFederate

A resource might require that the access token contains the scope `superuser`. Configure the `superuser` scope in PingFederate.

## Steps

1. [Enable Expressions](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_enable_disable_express.html) within PingFederate.

2. [Extend the Access Token Attribute Contract](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_defining_access_token_attribute_contract.html) to include the value `scope`.

3. Map the following value into the [access token attribute contract](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_wstrusttokenprocessormappingtasklet_wstrustattrcontractfulfillmentstate.html).

   | Contract | Source     | Value                                                                                              |
   | -------- | ---------- | -------------------------------------------------------------------------------------------------- |
   | `scope`  | Expression | @com.pingidentity.sdk.oauth20.Scope\@encode(#this.get("context.OAuthScopes").getValuesAsHashSet()) |

4. Manage the [OpenID Connect policy](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_configuring_oidc_policies.html) to add the following information:

   1. [Attribute Contract](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_policymanagementtasklet_createpolicycontractstate.html)— To extend the contract to include the `scope` attribute, select **Override Default Delivery** using the **ID Token**.

      |   |                                                                                                                                                                |
      | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      |   | This step is not applicable to PingFederate 9.0 and earlier. Instead, in the **Manage Policy** window, select the **Include User Info in ID Token** check box. |

   2. [Attribute Scopes](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_policymanagementtasklet_attributescopesstate.html)— From the **Scope** list, select `openid`, and from the **Attribute** list, select `scope`.

      |   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
      | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      |   | This feature does not exist in PingFederate versions earlier than 9.0. To work around this issue:1) Ensure PingAccess is configured to include `profile` in the list of **Web Session** scopes.

      2) In PingFederate, ensure the `profile` scope is [defined](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/rbk1564002990993.html) in **Scope Management**.

      3) During authentication, the user must accept usage of the `profile` scope. If the user does not accept usage of the `profile` scope, then the web session scope rule will always fail for that user. |

   3. [Contract Fulfillment](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_cibapolicymanagementtasklet_cibapolicycontractfulfillmentstate.html)— Modify the `scope`**Attribute Contract** to use `Access Token` as the **Source** with a **Value** of `scope`.