Hello, I have created sso integration, added scopes and attributes mapping, configured /userinfo, but all the descope user attributes are empty. How can I check what is the problem? in the audit logs there is no errors or anything helpful.

Check Audit Logs for UserInfo Response The audit logs should show the actual response from your IdP's

/userinfo

endpoint. Go to the Audit and Troubleshoot page and filter by "SSO" to see login events . Verify UserInfo Endpoint Configuration For OIDC integrations, user attributes come from the

/userinfo

endpoint you configured in Connection Settings . Check that: 1. The endpoint URL is correct and accessible 2. Required scopes are configured in Account Settings 3. Your IdP is returning the expected attributes in the response Test Attribute Mapping 1. Check your SSO mapping configuration matches the actual attribute names from your IdP 2. Verify the IdP is sending attributes with the exact names you've mapped 3. Ensure required scopes are granted for the attributes you're trying to retrieve The audit logs will show you exactly what data your IdP is returning, which helps identify if the issue is with the IdP response or your mapping configuration . SSO User and Group Mapping Guide | Descope Documentation SSO with OIDC Provider | Descope Documentation SSO Troubleshooting | Descope Documentation

everything is checked and correct, in audit logs there is only browser data{ "browser": "Chrome", "correlation_id": "3BAFDVT8I8cs4NUtLM41AkkFfNK", "device": "Desktop", "os": "macOS", "osVersion": "10.15.7", "request_details": { "contentLength": "0", "headers": { "descope": { "cf-bot-score": "82", "cf-connecting-ip": "88.119.11.24", "cf-ja3-hash": "8f0984659f69c5b5fed7b9b697112323", "cf-ja4": "t13d1517h2_8daaf6152771_b6f405a00624", "cf-ray": "9dec87529efbe1e2-FRA", "cf-threat-score": "0", "cf-verified-bot": "false", "sec-fetch-dest": "document", "x-asn": "8764", "x-request-id": "98a87fb715cecf766b980cdd24e50f3b" }, "http": { "sec-fetch-dest": "document", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" } }, "host": "api.euc1.descope.com", "method": "GET", "uri": "/v1/oauth/callback?code=xxxxx&scope=openid+email+profile+infare%3Acity-code&session_state=ienKzxr7wZlcjxwPXNlg4tJ33Nizz6OwSztoRwYu_tc.2332ffbb72aecf8af10a75e9c9b61f0b&state=s%2Fedda6a403f5d9542ce772806f76352111d3b615e9ef4f50d4fb2f047eca496da", "url": "/v1/oauth/callback?code=xxxxx&scope=openid+email+profile+infare%3Acity-code&session_state=ienKzxr7wZlcjxwPXNlg4tJ33Nizz6OwSztoRwYu_tc.2332ffbb72aecf8af10a75e9c9b61f0b&state=s%2Fedda6a403f5d9542ce772806f76352111d3b615e9ef4f50d4fb2f047eca496da" } }

Missing UserInfo Response in Audit Logs The audit log you shared only shows the OAuth callback request, but not the subsequent

/userinfo

endpoint call or response. This suggests the issue might be: Check Complete Login Flow Look for additional audit events after the callback - there should be separate events showing: 1. Token exchange with your IdP 2. UserInfo endpoint call and response 3. User creation/update with mapped attributes Verify UserInfo Endpoint Access Since you see the callback but no userinfo data, test if Descope can reach your

/userinfo

endpoint : 1. Check if the userinfo endpoint URL is correct in Connection Settings 2. Verify the endpoint is accessible from Descope's servers 3. Confirm your IdP requires the access token in the Authorization header Debug Token Exchange The callback shows a

code

parameter, but you need to verify: 1. The authorization code is being exchanged for an access token successfully 2. The access token has the required scopes for userinfo access 3. Your IdP is returning a valid access token If the userinfo call is failing silently, check your IdP's logs to see if Descope is making the request and what response it's receiving . SSO with OIDC Provider | Descope Documentation SSO Troubleshooting | Descope Documentation

so, I cannot see anything helpful in Audit logs, why are you saying to me to go and check them? I have already debug token exchange and verified my provider is returning everything correctly

You're right - if the audit logs aren't showing the userinfo response data, the standard troubleshooting approach isn't helpful here. Network Connectivity Issue Since your provider is returning data correctly but Descope user attributes are empty, this points to a network connectivity problem. Descope may not be able to reach your

/userinfo

endpoint . Check Firewall/Network Access If your IdP is behind a firewall or VPN, you need to whitelist Descope's static IPs. Based on your region, add these IPs to your firewall allowlist : US Region: •

35.170.24.133

•

3.212.215.29

•

52.44.167.251

EU Region: •

3.72.207.40

•

3.74.59.88

•

3.121.31.67

Test Direct Access Try accessing your

/userinfo

endpoint directly from an external network to confirm it's publicly accessible. If it requires VPN or internal network access, that explains why Descope can't retrieve the user data. The missing userinfo response in audit logs combined with empty user attributes strongly suggests a network connectivity issue rather than a configuration problem. SSO Troubleshooting | Descope Documentation Configuring Public Static IPs | Descope Documentation

if there is no correct vpn could the token be validated?

Token Validation Without Network Access Yes, the OAuth flow can complete and tokens can be validated even if Descope can't reach your

/userinfo

endpoint due to network restrictions. What Happens: 1. Authorization code exchange works (happens at token endpoint) 2. Access token gets validated using JWKS endpoint 3. Basic claims from the ID token are available 4.

/userinfo

call fails silently due to network access 5. User gets created but with empty custom attributes Check ID Token Claims Your user attributes might actually be in the ID token rather than requiring the

/userinfo

call. Many IdPs include user claims directly in the ID token when proper scopes are requested. Verify Token Contents Decode your ID token (use jwt.io) to see what claims are already present. If your user data is there, you may not need the

/userinfo

endpoint at all - just map the attributes from the ID token claims instead. Network Solution If you need

/userinfo

data, you'll need to either: • Make the endpoint publicly accessible • Whitelist Descope's static IPs in your firewall • Use a reverse proxy or API gateway that Descope can reach The token validation itself works fine - it's just the additional user attribute retrieval that's blocked by network access.

the host of JWKS endpoint is the same as /userinfo, so there is no network problem

Configuration Issue, Not Network You're correct - if JWKS works, network isn't the problem. This suggests Descope isn't calling your

/userinfo

endpoint at all, despite successful token exchange. Check Userinfo Endpoint Configuration Verify the exact

/userinfo

URL in your OIDC Connection Settings. Even a small typo or missing path component would cause this issue . Scope Requirements Your

/userinfo

endpoint may require specific scopes that aren't being requested. Check if your IdP requires: •

profile

scope for user attributes •

email

scope for email data • Custom scopes like

infare:city-code

(which I see in your callback URL) ID Token vs UserInfo Many OIDC providers include user claims directly in the ID token when proper scopes are present. Descope might be using ID token claims instead of calling

/userinfo

if all required data is already available. Debug Steps 1. Check your IdP's access logs to see if Descope is making

/userinfo

requests 2. Verify the exact userinfo endpoint URL in Descope matches your IdP configuration 3. Confirm all required scopes are configured in Account Settings The issue is likely either a URL mismatch or missing scopes preventing the

/userinfo

call. SSO with OIDC Provider | Descope Documentation

the token doesn't contain any claims, the attributes are in userinfo

Descope Should Call UserInfo Since your ID token is empty and attributes are only in

/userinfo

, Descope should be calling that endpoint. The documentation confirms that user claims and attributes are retrieved from the User Info Endpoint . Verify Exact Configuration Double-check your Connection Settings in the Descope Console: 1. User Info Endpoint URL - Must be exactly correct (no trailing slash, proper protocol) 2. Scopes - Include

profile

and any custom scopes your IdP requires for userinfo access 3. Access Token - Verify it has the right scopes to call

/userinfo

Force UserInfo Call Some OIDC implementations only call

/userinfo

when specific conditions are met. Check if your IdP requires: • Specific

response_type

parameter • Particular scopes in the initial authorization request • Custom headers or authentication method for the userinfo call Debug the Access Token Decode your access token to verify it contains the scopes needed to access

/userinfo

. If the token lacks required scopes, Descope might skip the userinfo call entirely. The fact that audit logs show no userinfo response suggests Descope isn't making the call at all, which points to either URL misconfiguration or scope/token issues preventing the request. SSO with OIDC Provider | Descope Documentation

Hi Diana, try to remove the jwks url and then we will take the data from the user info endpoint.

@Tal Kapitolnik, thanks I will try that

Great, happy to help