Extract username from access token

[bikerp]

Hi,
is it possible to extract user name from access token istead of ID token?

[levahim]

Not sure I follow. If the access token is a JWT, then yes, you can extract all the claims from it. Please explain in more detail.

[bikerp]

I meant the situation when IDP returns ID token and access token. It seem that the tomcat-oidcauth favors the ID token

[levahim]

Theoretically speaking, access tokens are not supposed to be parsed by the application, they should be treated as opaque (even if it's a JWT) and only used for authenticating remote API calls (e.g. as the Authorization HTTP header). If your IdP provides you with both access and ID tokens, they are supposed to match, so the username for the Tomcat realm should be available to you in the ID token as well. Isn't that the case?