JWT Populate lambda

If you would like to augment the claims provided in the JWT before it has been signed you can specify a lambda in the JWT configuration. This lambda will be invoked prior to the token being signed and issued to a user.

When you create a new lambda using the FusionAuth UI we will provide you an empty function for you to implement. If you are using the API to create the lambda you will need to ensure your function has the following signature:

function populate(jwt, user, registration) {
  // Lambda code goes here
}

This lambda must contain a function named populate that takes three parameters. The parameters that the lambda is passed are:

jwt - the claims object to be signed and return as the JWT payload
user - the FusionAuth User object
registration - the FusionAuth UserRegistration object

The two FusionAuth objects are well documented here in the User API and Registration API documentation. The JWT object is a JavaScript object containing the JWT payload. See OpenID Connect & OAuth 2.0 Token.

You may add or modify anything in the jwt object, however FusionAuth protects certain reserved claims. The following claims are considered reserved and modifications or removal will not be reflected in the final JWT payload:

exp
iat
sub

Prior to version 1.14.0 the following claims were considered reserved.

applicationId
aud
authenticationType
email
email_verified
exp
iat
iss
preferred_username
roles
sub

Assigning the lambda

Once a lambda is created, you must assign it to an Application. See the JWT tab in the Application configuration.

Example lambda

Here is an example of a simple Lambda that adds a few extra claims to the JWT issued to the User.

function populate(jwt, user, registration) {
  // Add a new claim named 'favoriteColor' from a custom data attribute on the user
  jwt.favoriteColor = user.data.favoriteColor;

  // Add a new claim named 'dept' using a custom data attribute on the registration
  jwt.dept = registration.data.departmentName;

  // Create an event log of type 'Debug' when the lambda has Debug enabled
  console.debug('Added custom claims to the JSON web token');
}