Skip to main content

​
Preface

In order to provide user attributes with Authlete, in accordance with OpenID Connect, you have to consider requirements on how identity provider (OpenID Provider; OP) should handle the information and choose the appropriate method.

​
Methods for providing user attributes

Authlete supports the following three methods for providing user attributes:
*EP: Endpoint, RP: Relying Party user-attributes-2 Providing ID Token from Token EP user-attributes-1 Providing ID Token from Authorization EP user-attributes-3 Providing response from Userinfo EP

​
How to choose the right method

  • Authlete never keeps user attributes for a long time.
    • In the case where Authlete provides the data from authorization EP or UserInfo EP, the data is removed on memory right after responded.
    • Even if Authlete provides the data via token EP (i.e. using authorization code), the data is removed after completion of cleanup process for expired authorization codes.
  • If you have some security requirement which prohibits Authlete from keeping user attributes even if they are encrypted and to be removed in a short period of time,  using authorization EP or Userinfo EP is the solution.
  • If sending user attributes to Authlete API is not permitted due to strict security reasons, consider the following options:
    • Create a UserInfo response by OP itself. On providing user attributes from UserInfo EP, an OP asks Authlete to analyze an access token and then creates a UserInfo response. The actual sequence is as follows:
    • Deploying Authlete’s on-premises package so that you can manage the Authlete service.
  • The other thing to be considered is operational requirement. If it recommends not to support implicit flows or Userinfo EP, the appropriate method would be going to issue authorization code from authorization EP and provide ID Token from token EP.