Facebook uses permissions to determine which user attributes and data an application has access to. You can configure the Facebook IdP Adapter to request additional permissions on behalf of your application.
By default, the Facebook Login Integration Kit gives your application access to the user’s public profile, including their name, profile picture, gender, and friends. If your application needs to access other user data, such as their email address or photos, you must request additional permissions. You can enter permissions when you get to the Configuring an adapter instance part of the setup process.
When a user signs on, Facebook asks them to give your application access to their photos. If they agree, the Facebook IdP Adapter sends an access token to your application along with the standard user attributes. When your application makes an HTTP request to the Facebook API, it can include this access token to get the photos from Facebook.