Retrieve user claims from the OpenID Connect UserInfo endpoint.
OpenID Connect defines a UserInfo endpoint that can return approved claims about the signed-in person. The client calls it with an access token and checks that the subject matches the identity result it already trusted.
Why this lesson?
A relying party authenticated Alex with OpenID Connect and now needs an authorized display name and email from the provider without treating the ID token as a directory record.
Learning goal and prerequisites
Call UserInfo with the access token
After OpenID Connect authentication, the relying party can call the provider’s UserInfo endpoint with the access token. The claims available depend on the authorization and requested scopes such as profile or email.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
An OpenID Connect ID token is primarily an authentication result. Applications sometimes need additional profile claims, such as a display name or email address, and those claims may change more often than the ID token’s short sign-in snapshot. The UserInfo endpoint provides a standard way to request approved user claims after authentication.
The client calls the UserInfo endpoint with an access token that is authorized for the needed claims. The provider returns information about the signed-in subject according to the scopes, claims request, and provider policy. This lets the client obtain profile data without treating the ID token as a complete user directory.
The client must still connect the UserInfo response to the identity it already verified. In particular, the subject identifier returned by UserInfo should match the subject from the trusted ID token. A mismatch means the profile data does not belong to the authenticated identity and should be rejected.
UserInfo is useful when the application needs provider-managed profile information, but it is not a substitute for local application data or authorization. An email address or group-like claim does not automatically grant access unless the application’s policy explicitly says it should.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.