By default users who authenticate via OpenID Connect will have some additional metadata fields. These fields will include every OpenID Claim that is provided in the authentication response (regardless of whether it is mapped to an Elasticsearch user property). For example, in the metadata field oidc(claim_name), "claim_name" is the name of the claim as it was contained in the ID Token or in the User Info response. Note that these will include all the ID Token claims that pertain to the authentication event, rather than the user themselves.

This behaviour can be disabled by adding populate_user_metadata: false as a setting in the oidc realm.