OAuth clients can optionally present access tokens to the UserInfo endpoint for the purpose of retrieving additional information about their users, the resource owners. The amount of information is customizable through the use of one or more OpenID Connect policies. Information may include specification-defined attributes (standard attributes) and non-standard attributes. Scopes, authorized by the users, also determines the attributes to be returned.

Note:

This endpoint is only active when the OAuth AS role and the OpenID Connect protocol are enabled on the System > Protocol Settings > Roles & Protocols screen.

Note:

This endpoint accepts HTTP GET requests without parameter. Clients must present valid access tokens for authentication.

Endpoint: /idp/userinfo.openid

Example
$ curl -s https://localhost:9031/idp/userinfo.openid -H 'Authorization: Bearer eyJ...9-g'|python -m json.tool
{
    "email": "auser@example.com",
    "phone_number": "(555) 555-5555",
    "phone_number_verified": true,
    "sub": "joe"
}

Note that the self-contained access token in the Authorization HTTP header is truncated for readability.

If the access token presented is not valid, PingFederate returns to the client HTTP status code 401 Unauthorized.

Self-contained tokens

If clients using self-contained access tokens are expected to contact the UserInfo endpoint, care must be taken when configuring the Client ID Claim Name and Scope Claim Name settings in the Access Token Management (ATM) instance (or instances) that these clients use.

Client ID Claim Name
The default value of this field is client_id. When this field is configured with a value, PingFederate includes the client ID of the requesting client as a claim in the self-contained tokens. The claim name is the value of the Client ID Claim Name field.
If the field value is removed and left blank, PingFederate does not include the client ID of the requesting client in the self-contained tokens. In this scenario, the ATM instance used by the default OpenID Connect policy must remain accessible to all clients (see Defining access control); otherwise, clients using self-contained access tokens issued by this ATM instance (configured without a Client ID Claim Name field value) will not be able to retrieve additional claims from the UserInfo endpoint. Instead, they receive from PingFederate an HTTP status code 401 Unauthorized.
Scope Claim Name
The default value of this field is scope. When this field is configured with a value, PingFederate includes the requested scopes as a claim in the self-contained tokens. The claim name is the value of the Scope Claim Name field.
If the field value is removed and left blank, PingFederate does not include any scope information in the self-contained token. As a result, clients using self-contained access tokens issued by this ATM instance (configured without a Scope Claim Name field value) will not be able to retrieve additional claims from the UserInfo endpoint. Instead, they receive from PingFederate an HTTP status code 403 Forbidden.