Hello Brian,
I gave this a spin (with 1.9.x and master) and I think that currently the only way to extend the information in the
userinfo endpoint is by defining a custom mapper and register that for the client you use to get the
access-token.
The protocol mappers of this client will be used for the userinfo endpoint. However the downside of this approach is that
this information is now also added to the access-token which you wanted to avoid.
It would be great of one had an additional switchable option for custom protocol mappers like "include in userinfo".
With this enabled one could control very explicitly what should go where.
I added a small curl command sequence below that can be used for testing.
Cheers,
Thomas
# Setup
KC_REALM=acme-test
KC_USERNAME=tester
KC_PASSWORD=test
KC_CLIENT=test-client
KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
KC_CONTEXT=auth
CURL_OPTS="-k -v --noproxy 192.168.99.1"
# Step 1 Request Tokens for credentials
KC_RESPONSE=$( \
curl $CURL_OPTS -X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "username=$KC_USERNAME" \
-d "password=$KC_PASSWORD" \
-d 'grant_type=password' \
-d "client_id=$KC_CLIENT" \
-d "client_secret=$KC_CLIENT_SECRET" \
"http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token" \
| jq .
)
# Step 2 Split tokens
KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
# Step 3 (Debug) Show all keycloak env variables
set | grep KC_*
# Step 4 Access Keycloak User Info
curl $CURL_OPTS \
-X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "access_token=$KC_ACCESS_TOKEN" \
"http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo" | jq .
# Step 5 Define a new protocol mapper for the client test-client in the admin-console
# via clients -> test-client -> mappers -> new -> as an example map a custom user attribute -> add to access token
# After that a request to the userinfo endpoint will show your custom attribute.
# Step 6 Access Keycloak User Info
curl $CURL_OPTS \
-X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "access_token=$KC_ACCESS_TOKEN" \
"http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo" | jq .