In OpenId Connect, why aren't requested claims included in the Id Token?

Question

In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client.

This Id token contains Claims about the authentication of an End-User by an Authorization Server. These claims consists of a set of required claims, some optional and "MAY contain other Claims".

At a later point, the client may hand the access token to an API, which in turn can retrieve information claims from the UserInfo endpoint.

What is the reason that the claims returned by the UserInfo endpoint is not returned directly to the client after the user has been authorized instead, as part of the Id Token? Why is the UserInfo endpoint necessary? If the claims were returned as part of the Id token, no additional claims would be needed.

Is it because the Id Token may contain data which one don't want to share with the API, such as a refresh token?

Answer 1

Consider that the point of the authorization server is simply to decide whether you should be allowed to do something. The point of the user info endpoint is to provide information about who you are. The fact that the authorization server can provide this information to you doesn't mean that it should.

In some cases the authorization server may not know who you are beyond some credential, so it defers to another server to provide more information.