UserInfo Populate Lambda

If you would like to augment the claims provided in the UserInfo response, you can specify a lambda in the Application's OAuth configuration.

When you create a new lambda using the FusionAuth UI we will provide you an empty function for you to implement.

Lambda Structure#

If you are using the API to create the lambda you will need to ensure your function has the following signature:

function populate(userInfo, user, registration, jwt, context) {
  // Lambda code goes here
}

This lambda must contain a function named populate that accepts the following parameters:

• userInfo - the claims object to be returned as a JSON payload. You can modify this object.
• user - the FusionAuth User object. This object is read-only.
• registration - the FusionAuth UserRegistration object. This object is read-only.
• jwt - the claims object from the provided JWT. This object is read-only.
• context - Available since 1.64.0 - an object containing the context of the request, including access to secrets. This object is read-only.

The two FusionAuth objects are well documented in the User API and Registration API documentation. The JWT object is a JavaScript object containing the JWT payload. See OpenID Connect & OAuth 2.0 Token.

You may add, remove, or modify anything in the userInfo object except for certain reserved claims. The following claims are considered reserved and modifications or removal will not be reflected in the final UserInfo response:

• email
• email_verified
• phone_number_verified
• sub
• tid

Assigning The Lambda#

Once a lambda is created, you must assign it to an Application. See the OAuth tab in the Application configuration.

Example Lambda#

Here is an example of a simple Lambda that adds a few extra claims to the UserInfo response.

function populate(userInfo, user, registration, jwt) {
  // Add a new claim named 'favoriteColor' from a custom data attribute on the user
  userInfo.favoriteColor = user.data.favoriteColor;
  // Add a new claim named 'dept' using a custom data attribute on the registration
  userInfo.dept = registration.data.departmentName;
  // Copy a claim named 'applicationId' from the provided JWT
  userInfo.applicationId = jwt.applicationId;

  // Create an event log of type 'Debug' when the lambda has debug logging enabled
  console.debug('Added custom claims to the UserInfo response');
}