OpenID Connect support for OAuth Authorization Server

When sign-in scopes (openid / profile / email) are granted on an OAuth Authorization Server, this authorization server acts as an OpenID Connect authorization server and releases the member's sign-in information (claims) to the client. id_token issuance and claim retrieval from the userinfo endpoint are enabled only when the granted scope contains openid.

For how to configure an OAuth Authorization Server, see OAuth Authorization Server.

Basic information

Item	Description
Type	OpenID Connect (id_token / userinfo / JWKS)
Target	OAuth Authorization Server (target domain API / Management / AdminMCP)
Use case	An OAuth client needs to retrieve the member's sign-in information (claims)

Metadata

Accessing [Metadata URL] in the OAuth Authorization Server editor returns this authorization server's configuration (Authorization Server Metadata) as JSON. In addition to basic OAuth 2.0 items such as issuer, authorization_endpoint, and token_endpoint, the response includes the following items.

• jwks_uri: URL of the JWKS endpoint
• userinfo_endpoint: URL of the userinfo endpoint (when openid is among the issuable scopes)
• subject_types_supported
• id_token_signing_alg_values_supported (RS256)
• claims_supported

The JWKS and userinfo endpoint URLs described below are both obtained from this response.

id_token

The token endpoint exchanges an authorization code, refresh token, or client credentials for an access token (its URL is available in the metadata as token_endpoint). When the granted scope contains openid, this endpoint's response includes an RS256-signed id_token (JWT) in addition to the access token.

The id_token always contains iss (issuer), sub (member ID), aud (client ID), iat, exp, and auth_time, plus nonce when a nonce was provided in the authorization request. For the claims added based on the profile and email scopes, see Scope-to-claim mapping.

JWKS endpoint

Serves the public key used to verify the id_token signature, as a JWK Set (RFC 7517). The endpoint URL is available in the metadata as jwks_uri. The signing key is managed per authorization server and is generated on first access.

userinfo endpoint

You can retrieve the member's claims using an access token.

Item	Description
Method	GET / POST
Authentication	Authenticated with the Authorization: Bearer <access_token> header (passing the access token as a query parameter is not supported).
Response	Returns the claims (always including sub) that correspond to the granted scopes, as JSON.

The endpoint URL is available in the metadata as userinfo_endpoint.

Scope-to-claim mapping

The claims returned in the id_token and from userinfo are determined by the granted scopes.

Scope	Claim	Source
openid	sub	Member ID
profile	name	Full name (family name + given name)
profile	family_name	Family name
profile	given_name	Given name
profile	preferred_username	Login ID
profile	updated_at	Member update date/time (Unix time)
email	email	Email address
email	email_verified	Always true (a constant, because Kuroco has no email verification flow)

Shared information on the consent screen

When a scope containing openid is requested, the consent screen shows the sign-in information to be shared with the client (the actual claim values) under "Shared information". You can review the member information that will actually be released, not just the scope names, before granting consent.

Related documents

• OAuth Authorization Server