JWT Populate Lambda - Power User Mode

[robotdan]

JWT Populate Lambda - Power User Mode

Problem

The JWT Populate lambda is great, but some claims are reserved and cannot be modified.

Reserved claims are as follows:

• applicationId
• aud
• authenticationType
• email
• email_verified"
• exp
• iat
• iss
• preferred_username
• roles
• sub

If I want to put something else in the JWT in the aud claim I cannot and I get sad. :-(

Solution

I would like to enable a power user mode on this lambda to assume all risk to let me do whatever I want!

Reserved claims:

• exp
• iat
• sub

It should be noted that once you remove applicationId, roles or aud FusionAuth may no longer be able to utilize the token. It will depend upon the workflow, but if you are only intending to use this token with an external service you can do whatever you want.

Alternatives/workarounds

You can modify or add new claims, or namespace claims in another object.

Additional context

Uh... reasons?

Related

#409

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.

[wxsdion]

Hello,
In my case this is a much needed feature. We are currently migrating to FusionAuth but the new JWT issued is much longer than the tokens on our old system because of all the reserved claims being added by FusionAuth. The new JWTs are longer than 512 characters which is a breaking change for some of our clients.
It would be great to indeed have a power user mode to strip down the token to the claims we only need !

[jerryhopper]

yay, this would help me a LOT.

[SebastianCanonaco]

I really need this!

[robotdan]

Available in 1.14.0, no configuration necessary, the lambda will now allow you to modify or remove claims with the exception fo iat, exp and sub.

[SebastianCanonaco]

Is there documentation about this?
Just a jwt.property = null?

[robotdan]

@SebastianCanonaco there will be, haven't updated it yet.

But you are correct, to remove a claim in the JWT set it to null in your lambda.