...
To use the reference token method set always_include_user_claims_in_id_token to 1 and the access_token_type_id to 2 or in Admin UI check the "Benutzerclaims in ID Token immer inkludieren" option in the client config and select “Access token type“ the Referenz option on the token tab.
In order to get the user claims, a call to the userinfo endpoint ({{idp_url}}/connect/userinfo) with a valid access token is needed.
...