Add standard OpenID Connect claims to id token

Get Help
,
1

I’m new to this forum and we just started using Auth0 - so I just may not have digged deep enough to find the right way to reach following:

We need some of the claims from the OIDC standard profile for our application (e.g., zoneinfo and locale). The documentation (OpenID Connect Scopes) tells that these are returned in an id token. However, I haven’t found a place where these properties can be administrated for a user in the Auth0 user management.

Then, I tried to add “locale” : “en-US” to the user_metadata of a user. Still, the id_token in the token response did not contain the locale. The only way I could reach that was to add a post-login action to the login flow and explicitly add the “locale”, “zoneinfo” … claims to the id token:

api.idToken.setCustomClaim(`zoneinfo`, event.user.user_metadata.zoneinfo);

Is this really the correct way in Auth0 to deliver standard OIDC claims to id tokens? Please note that this is not about custom claims which do not appear in the standard OIDC scopes.

By the way: unfortunately, I could not select the oidc and id_token tags for creating this topic.

3

Hi @jochen.walz,

Welcome to the Auth0 Community!

Yes, that’s correct! :clap:

Using a post-login action is the correct way to append custom claims to an ID or access token.

Let me also clarify that the profile scope, while it should contain the zoneinfo and locale claims, in this documentation, it states that profile will only return the name, family_name , given_name , middle_name , nickname , picture , and updated_at claims.

See screenshot below:

image
image804×271 32.9 KB

This means that you must use a post-login action script to append the zoneinfo and locale as custom claims to your ID token.

Let me know if you have any questions.

Thanks,
Rueben

4

Thanks for the clarification!

I had misunderstood the documentation - thought that “including” means that these are just examples, and apart from these, the full profile scope as defined in Final: OpenID Connect Core 1.0 incorporating errata set 2 (see 5.4) is supported out-of-the-box. Good to have the confirmation that I found the correct solution :slight_smile: .

5

Hi @jochen.walz,

That sounds good!

Feel free to reach out to us again if you have any questions.

Cheers,
Rueben