JWT Populate lambda

JWT Populate lambda

If you would like to augment the claims provided in the JWT before it has been signed you can specify a lambda in the JWT configuration. This lambda will be invoked prior to the token being signed and issued to a user.

When you create a new lambda using the FusionAuth UI we will provide you an empty function for you to implement. If you are using the API to create the lambda you will need to ensure your function has the following signature:

function populate(jwt, user, registration) {
  // Lambda code goes here
}

This lambda must contain a function named populate that takes three parameters. The parameters that the lambda is passed are:

  • jwt - the claims object to be signed and return as the JWT payload

  • user - the FusionAuth User object

  • registration - the FusionAuth UserRegistration object

The two FusionAuth objects are well documented here in the User API and Registration API documentation. The JWT object is a JavaScript object containing the JWT payload. See OpenID Connect & OAuth 2.0 Token.

You may add or modify anything in the jwt object, however FusionAuth protects certain reserved claims. The following claims are considered reserved and modifications or removal will not be reflected in the final JWT payload:

  • applicationId

  • aud

  • authenticationType

  • email

  • email_verified

  • exp

  • iat

  • iss

  • preferred_username

  • roles

  • sub

Example lambda

Here is an example of a simple Lambda that adds a few extra claims to the JWT issued to the User.

function populate(jwt, user, registration) {
  // Add a new claim named 'favoriteColor' from a custom data attribute on the user
  jwt.favoriteColor = user.data.favoriteColor;

  // Add a new claim named 'dept' using a custom data attribute on the registration
  jwt.dept = registration.data.departmentName;

  // Create an event log of type 'Debug' when the lambda has Debug enabled
  console.debug('Added custom claims to the JSON web token');
}