Customize userinfo endpoint

[Headmaster11]

Is is possible to set output data/schema for userinfo endpoint?

Currently I have only this data

{
    "amr": [
        "password"
    ],
    "aud": [
        "32c4ec1f-e746-4e38-b6fa"
    ],
    "auth_time": 1710413228,
    "iat": 171042,
    "iss": "https://projects.oryapis.com",
    "rat": 171042,
    "sub": "c25169dc-6b64-4900-9a5"
}

On this is the only possible behaviour?

[vinckr]

Hello @Headmaster11

Yes, it is possible to add custom claims to the userinfo response in Ory. Any information included in session.id_token when accepting the consent request will also be included in the response. Here is an example of how to do this:

import { Configuration, OAuth2Api } from "@ory/client"

const ory = new OAuth2Api(
  new Configuration({
    basePath: `https://${process.env.ORY_PROJECT_SLUG}.projects.oryapis.com`,
    accessToken: process.env.ORY_API_KEY,
  }),
)

export async function acceptConsent(consentChallenge: string) {
  const { data } = await ory.getOAuth2ConsentRequest({ consentChallenge })

  return await ory
    .acceptOAuth2ConsentRequest({
      consentChallenge: consentChallenge,
      acceptOAuth2ConsentRequest: {
        session: {
          access_token: {
            some_custom_claim: "some_custom_value",
          },
          id_token: {
            id_custom_claim: "some_value",
          },
        },
      },
    })
    .then(({ data }) => data)
}

In this example, some_custom_claim and id_custom_claim are custom claims added to the userinfo response. The values of these claims are some_custom_value and some_value respectively.
Please note that the /userinfo endpoint is publicly available. Its contents are thus as visible as those of ID Tokens. It is therefore imperative to not expose sensitive information without user consent.
Read the docs.

[Headmaster11]

Thanks for the answer @vinckr . And my apologies for the late response.

I'm not super familiar with Javascript. To implement ORY Oauth2 integration I use simple requests. So, I can't understand, where should I place this code? Or at what step (getting code, get token from code) it can be done?

[vinckr]

Accepting a consent request in the OAuth2 flow is typically done on your server side after the user has authenticated and given their consent for the requested scopes. Here's a simplified version of the OAuth2 flow to give you an idea of where this fits in:

1. Your application redirects the user to the OAuth2 provider's authorization endpoint (in this case, Ory).
2. The user authenticates and gives consent.
3. Ory redirects the user back to your application with an authorization code.
4. Your application exchanges the authorization code for an access token and ID token by making a request to the token endpoint.
5. The code you're asking about would be used here, on your server, to accept the consent request and add custom claims to the tokens.
6. Your application can now use the access token to make authenticated requests on behalf of the user.

So, you would use this code on your server after step 3 and before step 4. The consentChallenge parameter in the acceptConsent function would be the authorization code you received in step 3.