I have set up a WSO Identity server v5.3.0 and got OAuth2 authentication working against it. I have set it up with Google as a federated authenticator.
After following the instructions on wso2 identity server oauth userinfo only returns sub, I get my real email-address when querying the userinfo endpoint:
{
"email": “<my-real-email-adress>“,
"sub": "<my-real-email-adress>"
}
But after the accessToken is refresh-et I get
{
"sub": "<my-real-email-adress>@carbon.super"
}
So email is gone, and the sub is not correct any more.
How do I set it up so I can still use the userinfo endpoint after the token is refreshed?
It works after token-refresh if I turn off the federated authentication, and instead use the default authentication build-in in WSO2
Edit: Here is a screen shot of my service provider configuration
