UserInfo Endpoint¶

The UserInfo Endpoint is a protected resource that returns the authenticated user's claims. In order to obtain the requested claims, the RP sends a request to the UserInfo Endpoint using the Access Token.

Request¶

The UserInfo Endpoint MUST only support the method HTTP GET RFC 2616 and MUST accept and validate the Access Token sent in the Authorization field of the Header, whose type is Bearer RFC 6750.

The UserInfo Endpoint MUST support the method HTTP GET and HTTP POST RFC 2616 and MUST accept and validate the Access Token sent in the Authorization field of the Header, whose type is Bearer RFC 6750.

GET https://op.spid.agid.gov.it/userinfo
 Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImRCNjdnTDdja ...

Response¶

The content of the Response body MUST be a signed and encrypted JWT.

The JOSE header MUST contain the cty parameter (Content Type) configured to JWT (see RFC 7519#section-5.2).

The UserInfo Endpoint returns user attributes explicitly requested through the claims parameter or through the use of the scope parameter in the Authentication Request.

HTTP/1.1 200 OK
Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
Content-Type: application/jose

{
  "alg": "RSA-OAEP",
  "enc": "A256CBC-HS512",
  "kid": "HIvo33-Km7n03ZqKDJfWVnlFudsW28YhQZx5eaXtAKA",
  "cty": "JWT"
}
.
{
   "iss": "https://op.fornitore_identita.it",
   "aud": "https://rp.fornitore_servizio.it",
   "iat": 1519032969,
   "nbf": 1519032969,
   "exp": 1519033149,
   "sub": "OP-1234567890",
   "name": "Mario",
   "family_name": "Rossi",
   "https://attributes.spid.gov.it/fiscal_number": "MROXXXXXXXXXXXXX"
}

The JWE header MUST contain the parameter below:

Claim	Descrizione	Supportato da
alg	String. See Cryptographic algorithms..
kid	See RFC 7638#section_3.
enc	String. See Cryptographic algorithms..
cty	String. It MUST contain the value "JWT".

The JWE payload is a JWS containing the following parameters:

Claim	Description	Supported by
sub	String. Subject identifier, equal to the identifier already released in the ID Token. The RP MUST check that the value is equal to the one, contained in the ID Token.
iat	UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519.
exp	UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.
aud	String. Subject Identifier of the response recipient (RP). The RP MUST check that the value is equal to its own client_id.
iss	String. URI that uniquely identifies the OP.
<user claims>	The requested user claims.

The JWS header MUST contains the parameters below:

Claim	Descrizione	Supportato da
alg	String. See Cryptographic algorithms..
kid	See RFC 7638#section_3.
cty	String. It MUST contain the value "JWT".

Error codes¶

As defined for Token endpoint.

Docs Italia beta

Public documents, made digital.