Store user attributes in the context of access token or id token but not visible as part of /userinfo endpoint

[sagarshah1983]

Hello everyone,
After the authorize flow is completed and the access/id tokens are issued to the client (assuming we have to implement jwt tokens), can we associate any custom attributes related to the logged in user anywhere that we don't want to return in /userinfo endpoint response

Appreciate your inputs!

[vinckr]

Sorry, but it is not quite clear to me what the use case is.
Could you maybe share some more info on what you are trying to achieve, what attributes you are trying to relate to users and why it is not working at the moment?

[sagarshah1983]

Sorry, if my question is little ambiguous. I need some additional information about the user to be kept in access or ID token, which can later be used to determine what permissions the user has and what actions can a user take, but I dont want this internals to be known to 3rd party App (auth client) when they call /userinfo endpoint. Introspect is an internal endpoint, so its ok, if these values are returned in introspect endpoint response. If I understood it right, I can set some session related info in access token and id token when accepting the consent. If my access token is JWT, would that expose these attribute values, when client calls /userinfo endpoint using the access token? Or does userinfo endpoint only displays session data set in id_token?

[vinckr]

Thanks for clearing that up =)

I don't think storing this additional information in Hydra or a JWT is possible in the way you imagine it.

I would recommend that you write your own database table where you store this info, and look it up using the logged in user’s ID.
That would be really easy to setup, maintain, upgrade and so on.

[sagarshah1983]

Thanks for the clarifications! I understand Ory Hydra is not meant for user access and permission stuff, but was trying to see, if this can still be used to get some pointer information stored in access token (at the same time, hiding it from the 3rd party app/clients) and use to determine which policy needs to be enforced using an external solution

[vinckr]

Yea, I understand what you are looking for here.
One of our principles when building software is that we are looking to build services with very clear boundaries, that solve specific problems very well and leaves further issues to software that fits that problem.
So Ory Hydra is not the right pick for this part of your problem.
But dont fret, we thought of that as well and I believe Ory Keto could fit that role in your setup!
It also integrates nicely with Ory Hydra. Check out the Ory flavoured Access Control Policies, you can use Role Based Acces Control or Access Control Lists as well, depending on what fits your exact case better.

[sagarshah1983]

Thanks Vincent, Yes, thats in our roadmap for evaluation