Registry Context
The email claim is the End-User's preferred e-mail address. It is not guaranteed to be unique or stable.
Technical Summary
The email claim is a string standard claim whose value has to conform to RFC 5322 addr-spec syntax. Relying Parties must not treat it as unique, and OpenID Connect explicitly allows email values to be reused or changed over time.
When Used
Returned as a standard OpenID Connect Claim in the UserInfo Response or ID Token when requested.
Normative Requirements
claimed email address for a given End-User
openid-connect-core-1_0 - Section 5.7
change over time.
For instance, an Issuer MAY re-use an email Claim Value across different End-Users at different points in time, and the claimed email address for a given End-User MAY change over time.
email Claim value
openid-connect-core-1_0 - Section 5.1
conform to the RFC 5322 addr-spec syntax.
Its value MUST conform to the RFC 5322 addr-spec syntax.
Issuer
openid-connect-core-1_0 - Section 5.7
re-use an email Claim Value across different End-Users at different points in time.
For instance, an Issuer MAY re-use an email Claim Value across different End-Users at different points in time, and the claimed email address for a given End-User MAY change over time.
other Claims such as email, phone_number, preferred_username, and name
openid-connect-core-1_0 - Section 5.7
be used as unique identifiers for the End-User.
Condition: whether obtained from the ID Token or the UserInfo Endpoint
Therefore, other Claims such as email, phone_number, preferred_username, and name MUST NOT be used as unique identifiers for the End-User, whether obtained from the ID Token or the UserInfo Endpoint.
RP
openid-connect-core-1_0 - Section 5.1
rely upon the email claim value being unique.
The RP MUST NOT rely upon this value being unique, as discussed in .
Validation Guidance
Validate that an email claim value conforms to RFC 5322 addr-spec syntax.
Do not enforce uniqueness of email values across users or issuers.
Do not use email as the stable subject identifier for an End-User; use iss and sub instead.
Treat email values as mutable over time.
Security Notes
openid-connect-core-1_0 - Section 5.7
The email claim is not a stable or unique End-User identifier and must not be used as one.
Reference
Details
- Entry Id
email- Claim Name
email- Claim Description
Preferred e-mail address- Change Controller
OpenID_Foundation_ Artifact_ Binding_ Working_ Group - Reference
OpenID Connect Core 1.0 - Section 5.1