OIDC Enterprise Connection Does Not Call /userinfo Endpoint

Single Sign-On

Sep 10, 2025

Overview

This article addresses a situation where an Identity Provider (IdP) does not share user claims in the id_token.

Applies To

Identity Provider (IdP)
OpenID Connect (OIDC)
Claim Mapping

Cause

context.userinfo object is not mapped.

Solution

Okta's new OIDC attribute claims mapping function will automatically call the /userinfo endpoint if the source of a data element is mapped from context.userinfo object.

Navigate to Dashboard > Authentication > Enterprise and choose the OIDC provider.
Set the User Mapping accordingly. Refer to the Group claim mapping documentation.

For example:

Related References

Configure PKCE and Claim Mapping for OIDC Connections
Group claim mapping