How can I pass info from a external identity provider to a JWT in FusionAuth

dan

I am using an external identity provider which sends back some information that I want to add to my JWT. How can I do this?

dan

The way to do this is to use the user.data or registration.data objects as a transfer mechanism.

If you are using OIDC (SAML is much the same, but I'll use OIDC as an example), you can create a OIDC Reconcile Lambda. It might look like this:

// Using the JWT returned from UserInfo, reconcile the User and User Registration.
function reconcile(user, registration, jwt) {
  user.data.favoriteColor = jwt.favoriteColor;
}

So the jwt in this case is that returned from the OIDC identity provider. We store the data in user.data.

Now we need to pull it off of the user.data object using a JWT populate lambda. That might look a little something like this:

// Using the user and registration parameters add additional values to the jwt object.
function populate(jwt, user, registration) {
  jwt.favoriteColor = user.data.favoriteColor;
}

favoriteColor is now available as a claim in the JWT produced by FusionAuth.

Don't forget to assign your lambdas to the correct operations. The OIDC Identity provider needs to be configured with the reconcile lambda. The application's JWT tab is the right place to configure the use of the JWT populate lambda.

More information on all the lambda options available here: https://fusionauth.io/docs/v1/tech/lambdas/