userinfo-endpoint

Scope-based claims filtering for a UserInfo endpoint works by validating the access token, then returning only the user claims permitted by the requested scopes, such as profile, email, phone, and address. This approach preserves privacy by withholding unauthorized data.

To return verified_claims in an OAuth2 UserInfo response, your endpoint must check for the presence of the verified_claims scope in the access token. If granted, the endpoint includes identity assurance data alongside standard user claims in the response payload.

Yes, you can add custom claims to the UserInfo endpoint response in a multi-tenant deployment. The implementation supports filtering and returning custom claims prefixed with claims, ensuring tenant-specific data is accurately retrieved based on the validated access token.

Access token validation in retrieving user info ensures that the UserInfo endpoint securely authenticates the request before returning any data. It verifies token integrity and scope permissions, preventing unauthorized access to protected user attributes across multi-tenant environments.

Yes, the UserInfo endpoint implementation explicitly supports end-to-end testing integration. It aligns with existing validator, verifier, and claims creator components to ensure that token validation and scope-aware responses function correctly within the broader server configuration.

Custom claims might be missing from the OAuth2 UserInfo response if the required custom claim scopes are not granted to the access token. The endpoint filters claims strictly by scope, meaning unauthorized custom claims prefixed with claims are withheld from the response.