CODEWITHSUNDEEP
oauth-2.0
Sam Mathi
Sam Mathi

Reputation: 41

Returning custom attributes in OAath access token

We wish to return custom attributes from LDAP server as part of OAuth access token.

  1. Is this possible.
  2. Is it advisable? Is it a valid use of OAuth? Does the RFC discourage it?

I could not find a concrete answer, please avise. Thank you.

Upvotes: 4

Views: 927

Answers (2)

Gab
Gab

Reputation: 8332

  1. Yes
  2. Yes

It's indeed both possible and advisable, for example the spring security implementation provides an interface allowing to enrich the access token with custom properties.

See http://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/provider/token/TokenEnhancer.html

Upvotes: 0

Ramesh Lingappa
Ramesh Lingappa

Reputation: 2488

Yes you can add custom attributes in addition to standards properties like , (access_token,refresh_token, expiry) etc.

The spec does not impose strict property usage , check the sample response mentioned in spec OAuth2 Spec

Upvotes: 2

Related Questions