The resources on the web I have seen so far suggest that the 'sub' claim in a JWT identifies the principal.

According to this question, at least for some identity provider implementations, one cannot transfer sub values from one identity provider to another should the need arise.

This would suggest that it is better for apps to create their own user_id value for each new user and have that included in the JWT as a custom attribute to be returned by the JWT as described here.

Up to now I have been happily relying on the sub claim but now I need to move to a different identity provider (actually a different user pool still within Cognito) and all my sub values are going to change, outside of my control.

Does anyone know if it is actually recommended practice to NOT allow the 'sub' to leak into application space and to use a custom attribute in the JWT to provide the application-controlled user_id?

  • RFC 7519 addresses this. It states that you can establish mutually-agreed upon private claims, so long as you're willing to take the risk of collisions. Dec 3, 2020 at 15:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.