User info endpoint

Returns information about the authenticated user.

An access token should normally be included in the HTTP Authorization header.

(Authorization: Bearer <access_token>)

Example: http://127.0.0.1:8080/oidc/tenant1/userinfo-endpoint

If a client cannot use the Authorization header, the UserInfo endpoint can also accept access_token as a query parameter, but only when the OIDC module property allow_userinfo_access_token_in_query is explicitly set to true.

This is disabled by default and should only be used for legacy compatibility.

The access token used with the UserInfo endpoint must represent OIDC access and include the openid scope.

For newly issued opaque access tokens, FortifiedID Integrity persists the granted scope together with the token session and uses that when evaluating UserInfo requests. JWT access tokens should also carry the granted scope.

Claim expansion

When userinfo_claims uses expansion expressions such as ${exports.email}, unresolved export values are returned as empty claim values. Access does not return the unresolved expression string to the client.

For example, if userinfo_claims contains "email": "${exports.email}" and exports.email is not available, the UserInfo response contains "email": "".

User info endpoint errors

Error id	Description
`invalid_request`	The request is NOT valid. This is usually due to missing access token.
`invalid_token`	The provided access token has timed out.
`insufficient_scope`	The access token does not include the required `openid` scope.