UserInfo and revocation
UserInfo answers a user's names and groups to a token addressed to it, read at that moment; revocation ends a refresh family, and an access token runs out within five minutes.
UserInfo: GET|POST <issuer>/oauth2/userinfo
UserInfo (OpenID Connect Core §5.3) answers an access token addressed to its URL
and carrying openid. A client that calls it registers the URL as one of its
resources and asks for it as resource. The answer always holds the token's
subject, {"sub": "<subject>"}, and adds:
| The token carries | UserInfo adds |
|---|---|
profile | name, given_name and family_name as the user set them in the account portal, each absent while unset |
groups | groups, the ids of the company groups the user is in, and roles, the roles those groups carry, each sorted |
Both are read from the store at that moment, so a membership removed a moment ago
is gone from the next answer, and both appear nowhere else: not in the ID token
and not in the access token. Contact claims (address, phone) are not released.
Adding groups raised the consent policy to version 2 and adding the names under
profile raised it to version 3, so earlier grants were asked for again.
The token is read from the Authorization header alone, as Bearer, or as
DPoP with a proof over that token (ath, RFC 9449 §7.1) that is spent once; a
bound token is refused as a bearer token. Every bad token gets the same 401 with
error="invalid_token" in WWW-Authenticate, a token without openid gets 403
with error="insufficient_scope", and no answer is cached. A token from the client
credentials grant never carries openid, so it never reaches UserInfo.
Revocation: POST <issuer>/oauth2/revoke
The revocation endpoint (RFC 7009) authenticates the client exactly as the token endpoint does and revokes a refresh token together with its whole family.
- An unknown or already revoked token is answered
200, like a revoked one. - Another client's token is refused with
invalid_grantand left usable. token_type_hintis only a hint.- An access token is refused with
unsupported_token_type: it is never recalled and stays valid for at most its five minutes.
Discovery advertises the endpoint and its authentication methods.
How long a revoked grant keeps working
Every path that ends access, whether a user withdrawing a grant, signing out everywhere, an operator disabling an account or removing a client, revokes the refresh families at once and answers with the time by which the access tokens already issued stop working: at most five minutes on.