View Source Ueberauth.Strategy.Orcid (ueberauth_orcid v0.3.0)

ORCID authorization-code authentication through Ueberauth.

The default identity is the nonblank sub claim. Optional name claims may be absent; email is not mapped or used as an identity fallback. Granted scopes, not requested scopes, populate the returned credentials.

A custom :oauth2_module must implement authorize_url!/2, get_token/2 returning a token result tuple, and get/4 returning an OAuth2 response tuple. All three authentication stages use that module.

Configure an explicit trusted :callback_url. Without it, Ueberauth derives the URL using connection data and Host/forwarded headers; the host application must validate the host and strip untrusted forwarding headers at its proxy boundary. With :send_redirect_uri disabled, configure the OAuth client's redirect URI explicitly.

Credentials and extra.raw_info.token intentionally contain secrets. Never log the complete auth struct or raw provider data.

Summary

Functions

credentials(conn)

Returns granted scopes and the provider's optional refresh/expiry values.

default_options()

Callback implementation for Ueberauth.Strategy.default_options/0.

extra(conn)

Returns raw userinfo and the token for compatibility with existing consumers. This data is sensitive even after temporary connection fields are cleaned.

handle_callback!(conn)

Exchanges the code and validates userinfo after Ueberauth checks state.

handle_cleanup!(conn)

Removes temporary provider data after both successful and failed callbacks.

handle_request!(conn)

Redirects to ORCID with Ueberauth's state and the effective callback URI.

info(conn)

Joins valid given/family names, falling back to the credit-name claim name. The credit name remains the nickname. Missing names and email remain nil.

uid(conn)

Returns the validated :uid_field claim, which defaults to :sub.