Multi tenant database behind API, need to identify the user/tenant

[thijmen96]

I think custom claims could help you out here.

OpenID Connect Scopes

The docs above are for the ID token, but will work just fine for the access token as well. Basically you can add add a claim like http://example.com/tenant that contains the name of the company/tenant that the user is allowed to access. The way to add custom claims is through rules.

What is the correct way to add custom claims to id_tokens and the /userinfo endpoint and get the complete user profile?

The way to figure out if you’re using the new API Authorization features or not is: Check if you pass an audience parameter to the /authorize endpoint Check if the client_id you’re using for the request is marked as OIDC-Conformant under Clients → Settings → Advanced Settings → OAuth Check if you have a Default Audience configured here You only get a very small subset of the available properties because you are likely not requesting the appropriate scope in the /authorize request. For examp…

Keep in mind that to be OIDC conformant, you need to namespace your custom claims. That’s why I put http://example.com/ in my example.