wso2 identity server oauth userinfo only returns sub

2
votes

I have set up SP in wso2 Identity server and was able to get access_token in auth2 using playground. Ref : https://docs.wso2.com/display/IS510/OAuth+2.0+with+WSO2+Playground

Then I accessed userinfo endpoint like :

curl -k -H "Authorization: Bearer 603b0a91-0354-3b64-90e9-0eb1fdd8f162" https://localhost:9443/oauth2/userinfo?schema=openid

I always get JSON :

{"sub":"[email protected]"}

But there should also be other properties like first name,last name, email ... etc by default. How do I configure server to return all these information?

P.S tried IS 5.1 and 5.2

2
wso2wso2is
Possible duplicate of OpenId Connect with wso2 returns only sub claim - Bee

2 Answers

8
votes

It seems the logic to return claims by UserInfo Endpoint for scope openid is only the intersection of claims configure at OIDC file and claims configured in SP level are returned. Based on this logic I was able to solve this problem by following steps.

  1. WSO2 IS default openid scope is bound to set of predefined claims. You can configure this using oidc file found in /_system/config/oidc as in following screenshot. enter image description here
  2. Say for eg. if you want to get user's email address using openId scope by default it should comes with userInfo endpoint because "email" scheme is set-up by default (see above screenshot)
  3. According to default claims

Look at values of Claim Uri and Mapped Attribute of the email claim at http://wso2.org/oidc/claim dialect enter image description here

  1. Now you need to add correct http://wso2.org/claims claim which is mapped to the email claim in http://wso2.org/oidc/claim to the SP configuration. You can find it using same Mapped Attribute. i.e. For this example there is a same "Email" claim in http://wso2.org/claims. enter image description here
  2. Add "Email" claim in http://wso2.org/claims to the SP configuration enter image description here

Now for the request

curl -k -H "Authorization: Bearer 8b2805a7-5b74-33ee-84df-2a8c53a16f6c" https://localhost:9443/oauth2/userinfo?schema=openid

you would get response

{"sub":"[email protected]","email":"[email protected]"}
1
votes

The issue you are facing seems to be reported in [1]. Issue is originally reported for IS 5.1.0 and there were some inconsistencies in 5.2.0 release. According to the jira this will be fixed in 5.3.0 release, which is scheduled to release soon.

[1] https://wso2.org/jira/browse/IDENTITY-4250