Attribute or Claim Missing From an Okta ID Token
Last Updated:
Overview
An Okta ID token lacks expected attributes or claims when Okta returns the ID token alongside an access token, resulting in a thin token that only carries base claims. This issue presents as an application receiving an ID token that lacks specific user attributes during an OpenID Connect (OIDC) flow, even though the attributes contain data in the Okta User Profile or Application User Profile. Retrieve the missing user claims by sending the access token as a bearer token in the authorization header of a Userinfo request.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic
- OpenID Connect (OIDC)
Cause
When returned along with the access token, the ID token is considered a thin token. The thin ID token only carries base claims and some scope-dependent claims. For example, if the profile scope is requested, and a thin token returns, the ID token payload contains the preferred_username and name claims, but does not include other profile scope-dependent claims such as given_name or family_name.
Review the following examples of when the ID token and access token return together.
- Implicit flow, where
response_type=id_token+token. - Authorization code flow, where the
openidscope passes in the authorize request. - Resource owner password flow, where the
openidscope passes in the token request.
NOTE: When the ID token returns alone, such as in the implicit flow where response_type=id_token, the ID token is considered a fat token and should contain all profile attributes if the profile scope passes and groups if the groups scope passes.
This behavior is based on the OpenID specifications about scope-dependent claims. See the following quote from section 5.4:
- "The Claims requested by the profile, email, address, and phone scope values are returned from the UserInfo Endpoint, as described in Section 5.3.2 when a response_type value is used that results in an Access Token being issued. However, when no Access Token is issued (which is the case for the response_type value id_token), the resulting Claims are returned in the ID Token."
Solution
How are missing claims retrieved using the access token?
Retrieve all profile attributes and claims by identifying the returned access token and sending it as a bearer token in a Userinfo request.
- Obtain the access token returned along with the ID token.
- Include the Access Token as a Bearer token in the Authorization Header by replacing
<baseUrl>withhttps://<oktadomain.okta.com>or the custom domain, and send aPOSTrequest to:<baseUrl>/oauth2/v1/userinfo, if using the Org Authorization Server.<baseUrl>/oauth2/{authorizationServerId}/v1/userinfo, if using a Custom Authorization Server.
