How to access identity info in API

I’m trying to follow OpenID Connect best practices. For the simple scenario of calling API from application the OpenID Connect suggest to pass the Access Token (which is not included user identity), and if the API in some points need the user identity it should call /userinfo endpoint of OpenID Connect provider.

So the question is: Is it the best way to get the user identity in API?

Assume I have an end point named CreateOrderForCurrentUser() so each time any user call this api I need to call the /userinfo endpoint, it seems too much cost for calling an api.

  1. Why I don’t pass the Identity token to the API?
  2. Or Why I don’t put some identity claims in Access token?
  3. Should I use HOK Token instead of Access token?

It seems here is kind of same as my question: community.auth0.com/t/clarification-on-token-usage/8447#post_2

Which as my understanding means: put some identity claims (custom claims) in Access token and rely on that in API.

But still it doesn’t make sense. The OIDC insist to not use Access token as a source of Identity and now we are going to add identity claims inside the Access Token. Could any one clarify that?

Hi Saeid,

Your question sounds very similar to mine Cannot see userinfo in Api endpoint although I don’t know what language you are using. I’m using .Net Code for the API and Angular for the SPA.

Anyway, as I understand it, it should be possibly with the help of Claims to get some form of user identity as I’m trying to do with the standard OIDC scopes.

I’ll let you know if I have any success with this but feel free to keep an eye on my topic :blush:

You are correct that you should not use an access token as proof of identity, but before you get to your API you should have already authenticated the user and received an id_token for them. If you have already authenticated the user via OIDC, as far as I know there’s nothing wrong with adding custom claims to the access token to pass data to your API. Your API could also use the client credentials grant type to pull data from Auth0.

2 Likes

Thanks markd for your response, your statement is If we already authenticated by OIDC we could add identity claims in access token and pass it to the API. which is the exact things I’m looking for and is very helpful if you can provide a reference for that. I can’t find any things about that in documentations.

Hi @saeid,

Are you looking for documentation on how to do this?

General information on custom claims can be found here:

It is also worth browsing the sample rules that Auth0 provides, some of which are related to customer claims:

@markd, Not actually, I know how to add claims, I’m looking for the best practices. I want to be sure adding identity claims to the access token and rely on that in API does not broke any thing and is based on best practices or maybe the best practice is always call the /userinfo endpoint in API and don’t rely on Access token identity claims.

The API doesn’t know about the authentication process and don’t care about that. Any one any how pass the signed Access token to the API, it would be accepted. Now in API point of view is that proper way to rely on identity claims in Access Token? I have doubts. But I would be happy if we could ignore calling the /userinfo end point each time.

1 Like

I can share some (hopefully) informed views on this subject, but please do take them with a grain a salt and question stuff you disagree with or you don’t consider clear enough. When it comes with software the devil is on the details and in the security landscape it’s even more true so you need to consider best practices as what will likely be recommended for the majority of the scenarios and also what will likely be less risky; it does not mean that nothing else is possible.

For example, although the recommendation is indeed to use access tokens in requests to API’s this does not mean that there isn’t a specific scenario where technically it would also be okay to send an ID token instead.

Focusing on your particular questions and starting with the last one (3); we should not compare HOK and access tokens because they are not at the same level. In other words, you could question if in your scenario you should use bearer tokens or HOK tokens as this way and using the terminology of your linked page you would be choosing between two token profiles where each give you different characteristics.

At this time, the access tokens issued by the Auth0 service as part of API authorization are bearer access tokens so this question has only one answer if using the Auth0 service.

Jumping to the first question; it’s not that you cannot pass the ID token to the API, it’s just that the scenarios where that would be adequate are much more constrained. For example, an ID token is issued with the client identifier as the audience; it’s common to have multiple client applications so you have just coupled your API to how many client applications you have, because assuming you will validate the audience of the ID token, your API would now need to know the identifiers of every client.

For question (2) which I assume is also interested in why call /userinfo if you can include claims in the access token. I believe this can depend a lot on requirements and/or personal preferences. At this time the only format supported when issuing an access token to a custom API is the JWT format.

The above means that you have a self-contained token that once issued the API can mostly validate independently which is great in terms of scalability because the API does not need to make (frequent) external calls for validation purposes.

However, being self-contained this immediately means that any data you include directly in the token will be considered the truth for the lifetime of the token itself. If instead the API is calling /userinfo or even the Management API directly then you ensure fresh data at the cost of network overhead.

In conclusion, in my personal view the choice between network calls and embedded claims is more tied to the characteristics of the data you are interested in that just from a best practices point of view.

As a final note, even without any addition of custom claims an access token issued by the service in association to a custom API already conveys user identity. In particular, given the access token is a JWT, the sub claim will contain an identifier that uniquely identifies the end-user that authorized the current application to call the API on their behalf.

3 Likes

@jmangelo Thank you for taking time out to answer my question. It helps a lot.

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.