Make an OIDC IdPaccess_token available to the reconcile lambda

[andrewpai]

Make an OIDC identity provider's access_token available to the reconcile lambda

Problem

When using an OIDC identity provider, it would be useful to have the user's access token from the provider available to the reconcile lambda. This would allow the lambda to make API calls using the access token.

Solution

Provide the identity provider's access token for the authenticated user to the reconcile lambda.

Alternatives/workarounds

A lambda could potentially use a hardcoded API key for making calls to external APIs, however this isn't the best solution as authorization and auditing in the context of the user is impossible.

Related

• Pass encoded id token to openid reconcile lambda #2189
• OpenID Connect Reconcile Lambda: id_token with a RSA Signature is provided #2501

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.

Documentation

• Document new argument to the OpenID Connect reconcile lambda that contains the id_token and access_token

Release Notes

Expose the access_token returned by the Identity Provider to the Reconcile Lambda function. The access_token will now be passed to the lambda function in the tokens argument. Example: tokens.access_token.

[robotdan]

Handling via #2501