/oauth2/userinfo should not be dependent on the claims in token

[awoodobvio]

/oauth2/userinfo should not be dependent on the claims in token

Description

In our access token lambda we are stripping out the "email" and "email_verified" claims to avoid exposing PII. The intent was to let the code use the access token to call /oauth2/userinfo as per the spec to get the profile data. Unfortunately, the email claim is not being exposed on that endpoint if the token itself doesn't have it. This held us up for quite some time and required us to push the PII back into the access token for now, which is not a great solution.

Affects versions

1.32.1

Steps to reproduce

Steps to reproduce the behavior:

1. Get an access token without an email claim in it (lambda should strip it out)
2. Call /oauth2/userinfo
3. Notice that while all the other profile data is returned, email is not

Expected behavior

I expect the data from the user profile (including the email) to be provided in the returned userinfo record.

Platform

Hosted with FusionAuth

Related

• Custom scopes with oauth #275
• Feature : Requesting claims using the claims request parameter #308
• Grant Prompt Screen in OAuth Login Workflow #411
• Ability to remove PII from api (/oauth2/userinfo, /api/user) #1475

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context

n/a

[spwitt]

Internal

• https://github.com/FusionAuth/fusionauth-app/pull/400

[andrewpai]

This behavior will be supported using the scope handling policy added in 1.50.0.