Add OpenID claims "profile" and "email".

models/oauth2_application.go

@@ -567,6 +567,26 @@ func (token *OAuth2Token) SignToken() (string, error) {
 type OIDCToken struct {
 	jwt.StandardClaims
 	Nonce string `json:"nonce,omitempty"`
+
+	// Scope profile
+	Name              string             `json:"name,omitempty"`
+	FamilyName        string             `json:"family_name,omitempty"`
+	GivenName         string             `json:"given_name,omitempty"`
+	MiddleName        string             `json:"middle_name,omitempty"`
+	Nickname          string             `json:"nickname,omitempty"`
+	PreferredUsername string             `json:"preferred_username,omitempty"`
+	Profile           string             `json:"profile,omitempty"`
+	Picture           string             `json:"picture,omitempty"`
+	Website           string             `json:"website,omitempty"`
+	Gender            string             `json:"gender,omitempty"`
+	Birthdate         string             `json:"birthdate,omitempty"`
+	ZoneInfo          string             `json:"zoneinfo,omitempty"`
+	Locale            string             `json:"locale,omitempty"`
+	UpdatedAt         timeutil.TimeStamp `json:"updated_at,omitempty"`
+
+	// Scope email
+	Email         string `json:"email,omitempty"`
+	EmailVerified bool   `json:"email_verified,omitempty"`
 }
 
 // SignToken signs an id_token with the (symmetric) client secret key

routers/web/user/oauth.go

@@ -185,6 +185,21 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, clientSecret string) (*Ac
 				ErrorDescription: "cannot find application",
 			}
 		}
+		err = app.LoadUser()
+		if err != nil {
+			if models.IsErrUserNotExist(err) {
+				return nil, &AccessTokenError{
+					ErrorCode:        AccessTokenErrorCodeInvalidRequest,
+					ErrorDescription: "cannot find user",
+				}
+			}
+			log.Error("Error loading user: %v", err)
+			return nil, &AccessTokenError{
+				ErrorCode:        AccessTokenErrorCodeInvalidRequest,
+				ErrorDescription: "server error",
+			}
+		}
+
 		idToken := &models.OIDCToken{
 			StandardClaims: jwt.StandardClaims{
 				ExpiresAt: expirationDate.AsTime().Unix(),
@@ -194,6 +209,20 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, clientSecret string) (*Ac
 			},
 			Nonce: grant.Nonce,
 		}
+		if grant.ScopeContains("profile") {
+			idToken.Name = app.User.FullName
+			idToken.PreferredUsername = app.User.Name
+			idToken.Profile = app.User.HTMLURL()
+			idToken.Picture = app.User.AvatarLink()
+			idToken.Website = app.User.Website
+			idToken.Locale = app.User.Language
+			idToken.UpdatedAt = app.User.UpdatedUnix
+		}
+		if grant.ScopeContains("email") {
+			idToken.Email = app.User.Email
+			idToken.EmailVerified = app.User.IsActive
+		}
+
 		signedIDToken, err = idToken.SignToken(clientSecret)
 		if err != nil {
 			return nil, &AccessTokenError{