OpenID Connect UserInfo Endpoint Interview Questions and Answers

Learn the OpenID Connect UserInfo Endpoint with interview questions, Mermaid diagrams, Spring Security examples, and enterprise best practices.

UserInfo Endpoint - Interview Questions & Answers

The UserInfo Endpoint is a standard OpenID Connect (OIDC) endpoint that returns information about the authenticated user.

After successful authentication, a client application can use the Access Token to retrieve additional user profile information from the Identity Provider.

The UserInfo Endpoint provides a standardized way to obtain user details across providers such as Keycloak, Okta, Auth0, Microsoft Entra ID, Google Identity, and Amazon Cognito.

Q1. What is the UserInfo Endpoint?

Answer

The UserInfo Endpoint is an OpenID Connect endpoint that returns claims about the authenticated user.

The client sends a valid Access Token, and the Identity Provider responds with user profile information.

UserInfo Flow

flowchart LR

User --> Client

Client --> IdentityProvider

IdentityProvider --> AccessToken

Client --> UserInfoEndpoint

UserInfoEndpoint --> UserProfile

Benefits

Standard user profile retrieval
Provider-independent API
Supports Single Sign-On (SSO)

Q2. Why do we need the UserInfo Endpoint?

Answer

Although the ID Token contains identity information, applications often require additional user details that may not be included in the token.

Examples:

Email Address
Phone Number
Address
Profile Picture
Preferred Language

Authentication Flow

flowchart TD

Login --> IdToken["ID Token"]

IdToken["ID Token"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> UserinfoEndpoint["UserInfo Endpoint"]

UserinfoEndpoint["UserInfo Endpoint"] --> AdditionalUserDetails["Additional User Details"]

Q3. How does the UserInfo Endpoint work?

Answer

The typical flow is:

User authenticates.
Identity Provider issues an Access Token.
Client calls the UserInfo Endpoint.
Identity Provider validates the Access Token.
User profile information is returned.

Complete Flow

sequenceDiagram
participant User
participant Client
participant IdentityProvider
User->>Client: Login
Client->>IdentityProvider: Authentication Request
IdentityProvider-->>Client: ID Token + Access Token
Client->>IdentityProvider: UserInfo Request (Access Token)
IdentityProvider-->>Client: User Claims

Q4. What information does the UserInfo Endpoint return?

Answer

The response contains user claims.

Common claims include:

sub
name
given_name
family_name
preferred_username
email
email_verified
picture
locale
phone_number
address

User Claims

flowchart TD

UserInfo --> Name

UserInfo --> Email

UserInfo --> Phone

UserInfo --> Picture

UserInfo --> Address

Example response:

{
  "sub": "123456789",
  "name": "John Doe",
  "email": "[email protected]",
  "email_verified": true
}

Q5. How is the UserInfo Endpoint secured?

Answer

The UserInfo Endpoint requires a valid Access Token.

The Identity Provider validates:

Token Signature
Expiration
Audience
Issuer
Scopes

Validation Flow

flowchart TD

AccessToken["Access Token"] --> ValidateToken["Validate Token"]

ValidateToken["Validate Token"] --> Authorized?

Authorized? --> Yes

Yes --> ReturnUserInfo["Return User Info"]

Authorized? --> No

No --> 401Unauthorized["401 Unauthorized"]

Interview Tip

The UserInfo Endpoint does not accept ID Tokens.

It is called using an Access Token.

Q6. What is the difference between the ID Token and the UserInfo Endpoint?

Answer

ID Token	UserInfo Endpoint
JWT	REST Endpoint
Returned during login	Called after login
Contains identity claims	Returns additional profile claims
Validated by the client	Protected by Access Token

Comparison

flowchart LR

IdentityProvider --> IDToken

IdentityProvider --> UserInfoEndpoint

Client --> AccessToken

AccessToken --> UserInfoEndpoint

Best Practice

Use the ID Token for authentication and the UserInfo Endpoint when additional profile information is needed.

Q7. Which OAuth2/OIDC flow uses the UserInfo Endpoint?

Answer

The UserInfo Endpoint is commonly used with:

Authorization Code Flow
Authorization Code Flow + PKCE

It is typically not used with the Client Credentials Flow because there is no end user.

OIDC Flow

flowchart TD

AuthorizationCode["Authorization Code"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> UserinfoEndpoint["UserInfo Endpoint"]

UserinfoEndpoint["UserInfo Endpoint"] --> UserProfile["User Profile"]

Q8. What are common mistakes when using the UserInfo Endpoint?

Answer

Common mistakes include:

Sending an ID Token instead of an Access Token
Not validating the Access Token
Ignoring required scopes
Using HTTP instead of HTTPS
Logging sensitive profile data
Assuming all claims are always returned
Not handling expired tokens

Wrong Design

ID Token

↓

UserInfo Endpoint ❌

Correct Design

Access Token

↓

UserInfo Endpoint ✅

Q9. How is the UserInfo Endpoint used in Spring Security?

Answer

Spring Security supports OpenID Connect and can automatically retrieve user information from the UserInfo Endpoint after authentication.

Spring Security Architecture

flowchart TD

User --> SpringBootClient["Spring Boot Client"]

SpringBootClient["Spring Boot Client"] --> IdentityProvider["Identity Provider"]

IdentityProvider["Identity Provider"] --> IdToken["ID Token"]

IdentityProvider["Identity Provider"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> UserinfoEndpoint["UserInfo Endpoint"]

UserinfoEndpoint["UserInfo Endpoint"] --> SpringBootClient["Spring Boot Client"]

Supported Identity Providers

Keycloak
Okta
Auth0
Microsoft Entra ID
Google Identity
Amazon Cognito

Q10. What are the enterprise best practices for using the UserInfo Endpoint?

Answer

Follow these best practices:

Always use HTTPS.
Call the UserInfo Endpoint with an Access Token.
Request only the required scopes.
Validate Access Tokens before use.
Avoid requesting unnecessary user information.
Cache profile data only when appropriate.
Protect sensitive claims.
Log authentication events without exposing personal data.
Use least-privilege access.
Follow Zero Trust principles.

Enterprise OIDC Architecture

flowchart TD

User --> IdentityProvider["Identity Provider"]

IdentityProvider["Identity Provider"] --> IdToken["ID Token"]

IdentityProvider["Identity Provider"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> UserinfoEndpoint["UserInfo Endpoint"]

UserinfoEndpoint["UserInfo Endpoint"] --> SpringBootClient["Spring Boot Client"]

SpringBootClient["Spring Boot Client"] --> ProtectedApis["Protected APIs"]

UserInfo Retrieval Process

flowchart LR

AuthenticateUser["Authenticate User"] --> ReceiveAccessTokenCall["Receive Access Token → Call UserInfo Endpoint → Retrieve Claims → Create User Session"]

UserInfo Endpoint Overview

mindmap
  root((UserInfo Endpoint))
    Access Token
    User Claims
    Profile
    Email
    Phone
    Address
    Spring Security
    OpenID Connect

Senior Interview Tip

Many developers confuse the ID Token and the UserInfo Endpoint.

Remember:

ID Token → Confirms the user's identity and is validated by the client.
UserInfo Endpoint → Returns additional user profile information using an Access Token.

A production-ready enterprise authentication solution typically combines:

OpenID Connect
OAuth2 Authorization Code Flow
JWT ID Tokens
Access Tokens
UserInfo Endpoint
Spring Security
API Gateway
MFA
Zero Trust Architecture

Quick Revision

The UserInfo Endpoint is part of OpenID Connect.
It returns additional user profile information.
It requires a valid Access Token.
It is commonly used after successful authentication.
Use an ID Token for authentication and the UserInfo Endpoint for profile data.
Validate Access Tokens before calling the endpoint.
Request only the scopes you need.
Always use HTTPS.
Spring Security supports automatic UserInfo retrieval.
Use the UserInfo Endpoint to build secure, standards-based authentication systems.