4

I'm using OAuth2 with OpenAM 13. I need my client application to be able to retrieve user information by means the OpenAM "User Information" endpoint. However, I need to add / enhance the information provided to provide custom information in the user profile.

I was not able to see how to do this with the "User Information" endpoint. However, with the "Token Information" endpoint it is very easy to add information (adding scopes that match the profile name automatically adds the information in the JSON response). I tried the same for the "User Information" endpoint but this didn't work.

In this other POST I have read that the "User Information" endpoint information can be enhanced by using a 'script'. However I was not able to find how to do it: OpenAM - Use OAuth2 Access Token to get User Details?

Could someone help with this? I would really appreaciate it.

Thanks so much

Community
  • 1
  • 1
miguelfgar
  • 311
  • 1
  • 3
  • 9

1 Answers1

3

In the default claims script you can add additional profile attributes by

extending the 'profile' key of the 'scopeClaimsMap' and create a mapping for the new claim in the 'claimAttributes' map.

As the claims script is using the IDRepo API of OpenAM you need to make sure the attributes are configured in the 'User Attributes' section of the configured user data store.

Example: Additional claim "employee_number" for the "profile" scope.

claimAttributes = [
    "email": attributeRetriever.curry("mail"),
    "address": { claim, identity, requested -> [ "formatted" : attributeRetriever("postaladdress", claim, identity, requested) ] },
    "phone_number": attributeRetriever.curry("telephonenumber"),
    "given_name": attributeRetriever.curry("givenname"),
    "zoneinfo": attributeRetriever.curry("preferredtimezone"),
    "family_name": attributeRetriever.curry("sn"),
    "locale": attributeRetriever.curry("preferredlocale"),
    "name": attributeRetriever.curry("cn"),
    "employee_number": attributeRetriever.curry("employeeNumber")
     ]

scopeClaimsMap = [
    "email": [ "email" ],
    "address": [ "address" ],
    "phone": [ "phone_number" ],
    "profile": [ "given_name", "zoneinfo", "family_name", "locale", "name", "email", "employee_number" ]
 ]

The attribute 'employeeNumber' must be configured in the user data store config (which is there by default if you did not change anything)

Bernhard Thalmayr
  • 2,674
  • 1
  • 11
  • 7