title: oauth2-proxy userInfo API returns too little data. how to get more granual user data?
body: <p>I have integrated <a href="https://oauth2-proxy.github.io/oauth2-proxy/" rel="nofollow noreferrer">oauth2-proxy</a> with AWS Cognito leveraging Istio as described in <a href="https://www.jetstack.io/blog/istio-oidc/" rel="nofollow noreferrer">jetstack's</a> article, all is running in K8S.</p>
  <p>Now I am looking for an approach to get users' data and other <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html" rel="nofollow noreferrer">attributes</a> like <code>gender</code>, <code>phone_number</code>, or even get <code>cognito:groups</code> value in my frontend app. All this info is present in a JWT payload but not on the frontend side.</p>
  <p>Ideas:</p>
  <ol>
  <li>An API call to <a href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints/" rel="nofollow noreferrer">oauth2-proxy</a>'s <code>/auth2/userinfo</code> endpoint that returns users' email. Not much, right?</li>
  <li>I found that <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/userinfo-endpoint.html" rel="nofollow noreferrer">Cognito</a>'s oauth2/userInfo should return much more but I don't like the idea to lock my frontend with the <code>aws-sdk</code> or have any deals with JWT on FE side.</li>
  <li>Build a backend service that returns a JWT's payload output in custom header leveraging <a href="https://istio.io/latest/docs/reference/config/security/jwt/" rel="nofollow noreferrer">outputPayloadToHeader</a> Istio's RequestAuthentication feature, like <a href="https://hub.docker.com/r/containous/whoami" rel="nofollow noreferrer">whoami</a> does. But wait, one more microservice?</li>
  </ol>
  <p>None of these seems right to me.</p>
  <p>Is there a better approach that I should take? For example, to extend the oauth2-proxy's <code>/auth2/userinfo</code> endpoint to return more than just an <code>email</code></p>
  <p>I would appreciate any help<br />
  Thanks!</p>