Administrators must retrieve custom profile attributes using an Okta Org Authorization Server. Add a custom user profile attribute, map it to the OpenID Connect (OIDC) application, and call the /userinfo endpoint to retrieve the custom profile attributes without upgrading to a Custom Authorization Server.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Org Authorization Server
• OpenID Connect (OIDC)
• Implicit, Authorization Code, or Resource Owner Password Grant Types

How do administrators add custom profile attributes as claims?

Create a custom user profile attribute, assign a value to the user, create a corresponding attribute in the OIDC application, and map the attributes together.

1. Create a custom user profile attribute by navigating to Directory > Profile Editor > User (default).

2. Click on Add Attribute, enter the details, and Save.
    
3. Go to Directory > People > select the user > under the Profile tab > click Edit > add a value.
   
   
4. Create a custom attribute on the OIDC App by navigating to Directory > Profile Editor > Apps > click on the OIDC App > Add Attribute.
     
    
5. Under Mappings > Okta User to OIDC App, map the attribute from Okta to the OIDC App.

6. 1. Link the attribute (Select from the drop-down).
      
       
      
      
   2. Select the desired option.
       
   3. Save Mappings.

Retrieve the Custom Profile Attribute by Calling the /userinfo Endpoint

Call the /userinfo endpoint with the required scopes to find the custom profile attribute.

• Call the /userinfo endpoint to find the custom profile attribute, as documented in the Attribute/Claim Missing from ID Token article.

   NOTE: Both scopes (openid, profile) are required in the request to see the custom attribute at the /userinfo endpoint.

Related References

• How to Add Custom Attributes of User Profile as Claims in Tokens