oidc-userinfo-endpoint

To implement an OIDC UserInfo endpoint, you need to configure a TLS-secured HTTPS route that authenticates requests using Bearer access tokens and returns scope-filtered user claims.

A UserInfo endpoint returns claims based on requested scopes, providing subject, profile, email, address, and phone information when the corresponding openid, profile, email, address, or phone scopes are granted.

Validating access tokens at the UserInfo endpoint requires enforcing Bearer authentication, ensuring the token is active, and aligning the returned sub claim exactly with the subject identifier in the ID Token.

Yes, TLS is mandatory for a Basic OP UserInfo endpoint to secure token transmission and protect sensitive user claims during the authentication and data retrieval process.

The sub claim in the UserInfo response must match the ID Token to prevent subject mismatch vulnerabilities, ensuring the authenticated user data securely aligns with the issued token context.

Basic OP certification requires the UserInfo endpoint to comply with OpenID Connect Core 1.0 Section 5.3, enforcing TLS, Bearer authentication, sub alignment, and scope-based claims filtering.