Search code examples
oauth-2.0gitlabopenid-connect

Where to get Gitlab's OpenID ID Token?

Using Gitlab provided access tokens for the OpenID scope, i.e.

https://gitlab.com/oauth/userinfo?access_token=<bearer token>

returns a limited amount of information e.g. username, groups, etc. However, it does not return the user's email address.
The Gitlab documentation indicates that:

The claims sub, sub_legacy, email and email_verified are included in the ID token, all other claims are available from the /oauth/userinfo endpoint used by OIDC clients.

Given the AccessToken - how do I retrieve the ID token?

*This is a known / discussed issue cf. here

Solution

  • It all depends on what scopes you ask for when you first send the initial authentication request to GitLab.

    You need to ask for the email scope to get that information back and you should get the ID-token back at the same time as you get your first access-token.