Does / can Alexa replace its generated UserId for a linked user?

Question

We have an application utilizing Alexa skill with account linking for user details.

According to Alexa's account linking documentation:

Our skill is set up for Account Linking which in turn refers to a 3rd party (or it could be internal) Identity Management System (IMS) for user authentication. Our application (as well as our organization) does NOT internally maintain the app's user identities.

Let's say the user enabled our skill on her device, at which point (according to the above docs) she was issued an Alexa generated userId, something like:

"userId": "amzn1.ask.account.AFMWOL5WIGQZLYYEMM2IJL2BJ26ICPQHBPR2DSLRX46CHW36R6CPVH7RZTUZMBCHHJLQQNU3YO2BWZWNIRTM3PCAGTNZKILK33PM2XVI36H4RSINFH2A26OLURAIB2RVPV6GMK56BR5BLBIFNJKT64EANASM7IDTQJBQLGDIEUZHUIM6VSHTTOUPVPITIPOIOPESUK53TSALU5I"

Consequently, upon further interaction with the skill, she wanted to access some more personalized information which triggered account linking so her identity was confirmed and re-established via provided account linking details (OAuth 2 Authorization Code Profile), which, while doing so, as mentioned before contacted the 3rd party Identity Management System (not LWA) to verify the user identity:

• the user is presented with a login screen,
• she enters her credentials, say: "alice"/"password123"
• she answers the relevant questions to permit certain actions that our app can do on her behalf and
• is allowed to further interact with the system on a more personalized basis

Let's say that inside our app, we want to be able to identify the user by her real userId: alice and NOT the one auto-assigned by Amazon, as described above.

• Does Alexa allow for this?
• Upon successful account linking, does Alexa overwrite in its JSON request (or can it somehow pass it through, along with now embedded accessToken field) the userId it receives from the 3rd party Identity Provider) so that that "real" userId (is it called subjectId in OAuth parlance?)can then be used to identify the user actions during her further interactions with the app?

---

• If yes, how can we obtain the user details from JSON via Alexa Java API?

• If no, what would be possible ways to facilitate such ability?

• Can the real userId be obtained from the accessToken that Alexa puts in its request after authenticating a user? If so, how?

  I'm not sure if it's related to this, seems to be a similar request, has it been put on Alexa's roadmap or became a feature already?

Estey

Answer 1

This seems to be a detailed version of How to obtain userId specified by Alexa user during account linking

Generally speaking, after the user complete the OAuth authentication, the application (i.e. Alexa in this case) would receive a access_token and refresh_token. If you want any additional data, e.g. username alice, email, phone, address...etc., you would need to check with your OAuth provider and see if they have an API to retrieve those based on the access_token with the appropriate scope.

Laspisa