The OIDC UserInfo Endpoint. | |
The OIDC UserInfo Endpoint Method (GET or POST). | |
The debugger can initiate an UserInfo Endpoint call from either the frontend (browser) or from the backend API component. Certain IdPs make stringent assumptions about CORS and how calls will be originated. Especially concerning the Origin request header, which cannot be controlled from the browser. | Front Back |
The OIDC UserInfo Endpoint Scope. | |
The OIDC UserInfo Endpoint Claims. | |
The OAuth2 Access Token | |
Where to get the key that verifies a signed UserInfo Response (userinfo_signed_response_alg). Prefilled from the JWKS endpoint the OAuth2/OIDC workflow loaded. An HS* response ignores this and uses the Client Secret below instead. | |
The client_secret, used to verify an HS256/HS384/HS512 signed UserInfo Response — OIDC Core section 10.1's symmetric case, where the signing key is the client secret and there is no published key at all. NOT SAVED: this field is read when you press the button and never written to storage. | (not saved) |
The client's PRIVATE key, for an encrypted UserInfo Response (userinfo_encrypted_response_alg) — the private half of whichever key the client registered in its jwks. A private JWK or a PKCS#8 PEM. NOT SAVED: read when you press the button and never written to storage. | |
A signed UserInfo Response carries iss, and section 5.3.2 has the client check it. Prefilled from the issuer the OAuth2/OIDC workflow loaded. Leave it empty and the iss is reported but not checked. | |
A signed UserInfo Response carries aud, which must be or include this client's client_id — the member that stops a signed profile issued for one client being believed by another. Prefilled from the client_id. Leave it empty and the aud is reported but not checked. | |
| |
