Intermediate LevelAuthentication & Authorization
How does the OIDC /userinfo endpoint supply additional identity claims?
❓ Interview Prompt: Explain OIDC /userinfo GET/POST requests, Authorization Bearer token headers, identity scope filtering, and claim responses.
In OpenID Connect (OIDC), the '/userinfo' endpoint is a protected OAuth 2.0 Resource Server endpoint that returns detailed identity claims about the authenticated end-user.
Execution Flow:
1
Client completes OIDC flow, receiving an Access Token with scopes (e.g. 'scope="openid profile email address"').
2
Client makes an HTTP GET or POST request to '/userinfo' passing 'Authorization: Bearer <access_token>'.
3
The server validates the access token, inspects granted scopes, and returns a JSON payload containing requested user claims ('email', 'email_verified', 'name', 'picture', 'locale').
Code Implementation Example
json
{
"sub": "usr_10428891",
"name": "Alice Smith",
"given_name": "Alice",
"family_name": "Smith",
"email": "alice@company.com",
"email_verified": true,
"picture": "https://idp.company.com/avatars/alice.png"
}💡Standardized OIDC /userinfo JSON response payload.
🎯 Interview Key Takeaway
The OIDC /userinfo endpoint accepts Bearer access tokens and returns detailed user profile identity claims filtered by granted scopes.
#OIDC#Userinfo#Claims#Identity#Intermediate
Back to all Authentication & Authorization Questions→