Nested Objects Returned From a Third Party IDP on an OIDC Connection Show as [object Object]

An OpenID Connect (OIDC) connection is configured on the front channel and the third party Identity Provider (IDP) is configured to return an object like the below in the id_token, note the params object at the bottom of the token:

{
  "sub": "00ulzphj8hwmkoI5d7",
  "name": "Joe Bloggs",
  "locale": "en_US",
  "email": "fake@fake.com",
  "ver": 1,
  "iss": "https://idp.com/oauth2/some-id",
  "aud": "0oalz0t584oET4Ri55d7",
  "iat": 1758871661,
  "exp": 1758875261,
  "jti": "ID.vGXFKzV7nhk6BEnLrUD3Fhix6m1pj5C2JW8",
  "amr": [
    "mfa",
    "otp",
    "pwd"
  ],
  "idp": "00olyx5sui0JNzJ7",
  "nonce": "HlK39GEOgdkBQzyqbTZ24y9IT_BfrnaEH4",
  "preferred_username": "fake@fake.com",
  "given_name": "Joe",
  "family_name": "Bloggs",
  "zoneinfo": "America/Los_Angeles",
  "params": {
    "picture": "https://url-to-picture/picture-id"
  }
}

Custom mapping is needed therefore, the use_map option is selected and the custom mapping is configured as below to pull the params object into the user profile under a custom variable pic_param:

{
  "attributes": {
    "name": "${context.tokenset.name}",
    "email": "${context.tokenset.email}",
    "username": "${context.tokenset.preferred_username}",
    "pic_param": "${context.tokenset.params}"
  },
  "mapping_mode": "use_map",
  "userinfo_scope": "openid email profile groups"
}

However, this results in the following property within the user profile post login, notice the pic_param property:

{
    "created_at": "2025-09-25T07:30:44.606Z",
    "email": "fake@fake.com",
    "identities": [
        {
            "user_id": "00ulzphj8kO2oI5d7",
            "provider": "oidc",
            "connection": "oidc_connection",
            "isSocial": false
        }
    ],
    "name": "Joe Bloggs",
    "nickname": "fake",
    "pic_param": "[object Object]",
    "picture": "https://s.gravatar.com/avatar/gfdjgdjkfgkhdfghdghjkhg.png",
    "updated_at": "2025-09-26T07:27:42.300Z",
    "user_id": "oidc|00ulzphj8kO2oI5d7",
    "username": "fake@fake.com",
    "last_ip": "165.85.123.123",
    "last_login": "2025-09-26T07:27:42.299Z",
    "logins_count": 2,
    "blocked_for": [],
    "guardian_authenticators": [],
    "passkeys": []
}

• OpenID Connect (OIDC) Connection

As of September 2025, this is a known issue on the Auth0 side. A backlog item has been created to address this issue going forward.

The following workarounds are available to resolve this issue:

1. Configure the property to be sent by the IDP in a non-nested fashion so that use_map can work. For example, a typical id_token from a third party IDP might look like the following, notice the new params_picture property:

{
    "created_at": "2025-09-25T07:30:44.606Z",
    "email": "fake@fake.com",
    "identities": [
        {
            "user_id": "00ulzphj8kO2oI5d7",
            "provider": "oidc",
            "connection": "oidc_connection",
            "isSocial": false
        }
    ],
    "name": "Joe Bloggs",
    "nickname": "fake",
    "params_picture": "https://url-to-picture/picture-id",,
    "picture": "https://s.gravatar.com/avatar/gfdjgdjkfgkhdfghdghjkhg.png",
    "updated_at": "2025-09-26T07:27:42.300Z",
    "user_id": "oidc|00ulzphj8kO2oI5d7",
    "username": "fake@fake.com",
    "last_ip": "165.85.123.123",
    "last_login": "2025-09-26T07:27:42.299Z",
    "logins_count": 2,
    "blocked_for": [],
    "guardian_authenticators": [],
    "passkeys": []
}

Reference the new property on the OIDC connection within the Auth0 Dashboard like so in the mappings:

{
  "attributes": {
    "name": "${context.tokenset.name}",
    "email": "${context.tokenset.email}",
    "username": "${context.tokenset.preferred_username}",
    "pic_param": "${context.tokenset.params_picture}"
  },
  "mapping_mode": "use_map",
  "userinfo_scope": "openid email profile groups"
}

2. Alternatively, use the mapping mode bind_all (so everything from the IDP can come across into the Auth0 user profile `as is`) instead of using use_map.