Unable to retrieve Claims in either the id_token or userinfo requests

Question

I'm trying to retrieve the CIF and also the Tax Id of the logged in user following your documentation. When trying to request that information via additional claims via the Consumer API, with the scope of &scope=openid I'm supplying the below claims parameter in my authorization request. Making sure that the External App is configured with the claims access in the Banno portal, I don't get anything in my response id_token. I've also attempted to switch this to the userinfo leveraging the opid/me resource which just returns the user "sub".

Claims readable: claims={"id_token":{"https://api.banno.com/consumer/claim/customer_identifier":null}}

Here it is url encoded: claims==%7B%22id_token%22%3A%7B%22https%3A%2F%2Fapi.banno.com%2Fconsumer%2Fclaim%2Fcustomer_identifier%22%3Anull%7D%7D

decoded jwt id_token repsonse:

"id_token": {
    "header": {
      "alg": "RS256",
      "typ": "JWT",
      "kid": "sig-rs-0"
    },
    "body": {
      "sub": "sub uuid",
      "at_hash": "ShHf2gRtROCBdE-j_5YZkw",
      "aud": "aud uuid",
      "exp": 1668092577,
      "iat": 1668088977,
      "iss": "https://api.banno.com/a/consumer/api/v0/oidc"
    }
  }

using the same example switching the claims key to "userinfo" and making a request to .../a/consumer/api/v0/oidc/me I only get this response:

UserInfo Response: {"sub":"sub uuid"}

In either scenario, I'm expecting the following example to be in the response:

"https://api.banno.com/consumer/claim/customer_identifier": "AAA1234",

However I don't get anything no matter what I do. What am I missing here?

score 0 · Answer 1 · answered Nov 11 '22 at 01:47

It looks like there is an extra = in the encoded version. If I take what you've posted in the question, claims==%7B%22id_token%22%3A%7B%22https%3A%2F%2Fapi.banno.com%2Fconsumer%2Fclaim%2Fcustomer_identifier%22%3Anull%7D%7D and decode it, I get claims=={"id_token":{"https://api.banno.com/consumer/claim/customer_identifier":null}}, which has an extra = next to the claims parameter name.

That seems to have the effect of the name of the claim not matching up with what is expected, therefore that claim's value is not included in the Identity Token (and isn't available from the UserInfo endpoint).

The Claims in the Identity Token guide will be helpful to review.

Unable to retrieve Claims in either the id_token or userinfo requests

1 Answers1