UserInfo Populate Lambda

To add or change claims in the UserInfo response, assign a lambda in the Application's OAuth configuration.

When you create a lambda in the Admin UI, FusionAuth provides an empty function for you to implement.

Lambda Structure#

When you create the lambda with the API, give the function the following signature:

function populate(userInfo, user, registration, jwt, context) {
  // Lambda code goes here
}

The lambda must contain a function named populate that accepts the following parameters:

• userInfo: the claims object that FusionAuth returns as a JSON payload. You can modify this object.
• user: the FusionAuth User object. This object is read-only.
• registration: the FusionAuth UserRegistration object. This parameter is null when the user is not registered for the application. This object is read-only.
• jwt: the claims object from the provided JWT. This object is read-only.
• context: Available since 1.64.0 an object containing the context of the request, including access to secrets. This object is read-only.

The User API and Registration API documentation describe the user and registration objects. For the claims in the jwt object, see OpenID Connect & OAuth 2.0 Token.

You can add, remove, or change any claim in the userInfo object, except the reserved claims. To remove a claim, set the claim to null. Deleting a claim with delete has no effect. FusionAuth discards changes to the following reserved claims:

• email
• email_verified
• phone_number_verified
• sub
• tid

Assigning the Lambda#

After you create the lambda, assign the lambda to an Application on the OAuth tab of the Application configuration.

Example Lambda#

The following lambda adds the user's department from user.data and the user's roles for the application as namespaced claims. The lambda also removes the birthdate claim, so the UserInfo response doesn't share the user's birth date with the application:

// adds the user's department and roles, and removes the birthdate claim
function populate(userInfo, user, registration, jwt, context) {
  userInfo['https://example.com/department'] = user.data.department || null;
  userInfo['https://example.com/roles'] = registration ? registration.roles || [] : [];
  userInfo.birthdate = null;
}

When user.data has no department, the lambda sets the department claim to null, and FusionAuth leaves the claim out of the response.