EntraID: disable calling userinfo endpoint

[drpuur]

We are using mod_auth_openidc (2.4.19.2) with EntraID. The access token does not have the scope [1] to call the userinfo endpoint (https://graph.microsoft.com/oidc/userinfo). This will lead to unsuccessful and thus unnecessary calls to the userinfo endpoint and also to errors in the logs [2].

My question: Is there a way to suppress calling the userinfo endpoint?

We use "OIDCRemoteUserClaim oid" to have a meaningfull user in the logs, but in my understanding that should be taken from the ID Token, not from the Userinfo Endpoint.

These are the relevant OIDC* Settings:

OIDCProviderMetadataURL https://login.microsoftonline.com/3ae7c479-0cf1-47f4-8f84-929f364eff67/v2.0/.well-known/openid-configuration
OIDCRedirectURLsAllowed https://login.microsoftonline.com/3ae7c479-0cf1-47f4-8f84-929f364eff67
OIDCPassAccessToken On
OIDCPassIDTokenAs serialized claims
OIDCRemoteUserClaim oid
OIDCPassClaimsAs environment none
OIDCClientID XXX
OIDCClientSecret XXX
OIDCCryptoPassphrase XXX
OIDCRedirectURI /callback
OIDCScope "profile openid email offline_access api://XXX/myscope"

[1]
I even tried to add https://graph.microsoft.com/User.Read to the scopes, but this did not work.

[2]

Version Info: 
[auth_openidc:info] - - mod_auth_openidc-2.4.19.2 - init - cjose 0.6.2.4, openssl-3.5.5, EC=yes, GCM=yes, Memcache=yes, Redis=yes, JQ=no


[2026-06-04 09:17:59.044736] [auth_openidc:error] 1.2.3.4:63278 aiEmpodlOskIaDDiLfDHnQXXXXg oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: "{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":{"date":"2026-06-04T07:17:59","request-id":"63ec9e88-d8a0-4c63-ab42-9994594XXXXX","client-request-id":"63ec9e88-d8a0-4c63-ab42-9994594XXXXX"}}"
[2026-06-04 09:17:59.044794] [auth_openidc:error] 1.2.3.4:63278 aiEmpodlOskIaDDiLfDHnQXXXXg oidc_userinfo_retrieve_claims: resolving user info claims with the provided access token failed, nothing will be stored in the session

[drpuur]

Followup: we just tested with the newest release of mod_auth_openidc (2.4.19.3) and the first error message is slightly different now:

[auth_openidc:info] - - mod_auth_openidc-2.4.19.3 - init - cjose 0.6.2.6, openssl-3.5.5, EC=yes, GCM=yes, Memcache=yes, Redis=yes, JQ=no

[2026-06-04 14:02:44.922593] [auth_openidc:error] 1.2.3.4:52105 aiFpZG-OlVYWu7eyhEXJrQXXXXX oidc_proto_userinfo_request_validate_sub: mandatory claim ("sub") was not returned from userinfo endpoint (https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse)
[2026-06-04 14:02:44.923009] [auth_openidc:error] 1.2.3.4:52105 aiFpZG-OlVYWu7eyhEXJrQXXXXX oidc_userinfo_retrieve_claims: resolving user info claims with the provided access token failed, nothing will be stored in the session

[drpuur]

Just for Info: I also tried to override the UserInfo Endpoint using OIDCProviderUserInfoEndpoint, but there does not seem to be an option to unset it (it requires an argument and "" does not work). It would be nice following was possible:

OIDCProviderUserInfoEndpoint none

[zandbelt]

see a7c5e35, thanks for the suggestion; this will be part of the upcoming 2.4.19.4 release

[drpuur]

Great, thanks a lot!