google-apigoogle-openidgoogle-openidconnect

Why is Google's OpenId Connect API not sending back all claims?

Google's OpenId Connect discovery document shows that the supported Claims are:

"claims_supported": [
  "aud",
  "email",
  "email_verified",
  "exp",
  "family_name",
  "given_name",
  "iat",
  "iss",
  "locale",
  "name",
  "picture",
  "sub"
]

and the supported Scopes are

"scopes_supported": [
  "openid",
  "email",
  "profile"
]

I was expecting to get all of the supported claims when I send a GET request to the OpenId Connect UserInfo end point (https://www.googleapis.com/oauth2/v3/userinfo). However, I seem to be getting a subset of the supported claims:

{
  "sub": "...",
  "name": "...",
  "given_name": "...",
  "family_name": "...",
  "picture": "...",
  "email": "...",
  "email_verified": true,
  "locale": "..."
}

Does anyone know why I am missing a few of the supported claims in my response?

Solution

  • You won't always get back all of the supported claims. Supported claims means exactly that - they're supported but it's possible that the user does not have issued claims for each supported claim type.