# Oauth2 plugin: avatar not used
**URL:** https://meta.discourse.org/t/oauth2-plugin-avatar-not-used/295121
**Category:** SSO
**Tags:** oauth2
**Created:** [February 12, 2024, 8:39pm UTC](https://meta.discourse.org/t/oauth2-plugin-avatar-not-used/295121 "2024-02-12T20:39:40Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@jmlord](https://meta.discourse.org/u/jmlord)
#### Post date: [February 12, 2024, 8:39pm UTC](https://meta.discourse.org/t/oauth2-plugin-avatar-not-used/295121/1 "2024-02-12T20:39:40Z")
Hi,
I’m splitting into a topic an issue referenced here [Discourse OAuth2 Basic - #304 by nodomain](https://meta.discourse.org/t/discourse-oauth2-basic/33879/304)
here [Discourse OAuth2 Basic - #316 by jmlord](https://meta.discourse.org/t/discourse-oauth2-basic/33879/316) (that’s me)
and maybe here [User avatar not updating on re-log in](https://meta.discourse.org/t/user-avatar-not-updating-on-re-log-in/268071)
The account is created successfully but the avatar is not included. Sample response:
```plaintext
Body: {
"access_token":"...",
"token_type":"bearer",
"expires_in":"3600",
"scope":"profile",
"profile" : {
"id":1234,
"email": "...",
"name": "...",
"picture": "https://somedomain.com/somevalidpicture.jpg"
}
}
```
Variable `oauth2 callback user info paths` includes value `avatar:profile.picture` and it is correctly parsed, since it appears in the following log:
```plaintext
OAuth2 Debugging: after_authenticate response:
creds: {"token"=>"...", "expires_at"=>1702053692, "expires"=>true}
uid: 1234
info: {"email"=>"...", "name"=>"...", "avatar"=>"https://members.geobon.org/pages/profile-picture/..."}
extra: {}
```
I checked that the picture address is correct, and it’s size is 300x300. Here is a [sample](https://members.geobon.org/pages/profile-picture/62146-17077.jpg).
I checked the logs of the server where the pictures lie, and there was no attempt to download this picture during account creation and initial login.
Any idea why this does not work for us? (clearly it works with some other configs…)
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [February 13, 2024, 12:17am UTC](https://meta.discourse.org/t/oauth2-plugin-avatar-not-used/295121/2 "2024-02-13T00:17:44Z")
hmmm, I’m not sure it’s possible to get the avatar
> [@Populating user avatars with Microsoft Graph Oauth2](https://meta.discourse.org/t/populating-user-avatars-with-microsoft-graph-oauth2/191074/2):
>
> The OAuth2 plugin only allows requesting the data from a single endpoint (the oauth2 user json url). All of the json \*\*\* path settings refer to locations within the JSON data, not separate API endpoints. Taking a quick look at the [graph.microsoft.com api docs](https://docs.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http) it doesn’t look like the /me endpoint includes the avatar URL by default. Even if you were able to [fetch the profilePhoto resource](https://docs.microsoft.com/en-us/graph/api/resources/profilephoto?view=graph-rest-1.0), it looks like it returns a “photo ID” rather than a URL. So unfortunately I think you would need to develo…
---
### Author:  [@jmlord](https://meta.discourse.org/u/jmlord)
#### Post date: [February 13, 2024, 2:15pm UTC](https://meta.discourse.org/t/oauth2-plugin-avatar-not-used/295121/3 "2024-02-13T14:15:17Z")
Hi Lillian, thanks for helping.
The quoted post seems to be in the case where the endpoint was not a direct link to the file. It’s a bit different here, where we directly provide the file link.
Also, this seems to work in some cases:
> [@Discourse OAuth2 Basic](https://meta.discourse.org/t/discourse-oauth2-basic/33879/306):
>
> It seems like the plugin only updates the avatar/username on initial creation of the user, not on everytime they log in. Is there anyway to fix this and have the plugin update the avatar as well on login/reconnection?
Also, tooltip of `oauth2 callback user info paths` property says
> Paths in the token response to other user properties. Supported properties are name, username, email, email\_verified and avatar. Format is property:path, eg: name:params.info.name
If not by URL, how do we do it? Should I base64encode it in the file?
Edit: Let me try the 2-step process, where the image avatar result is in another query, instead of the token response, and I’ll post again.
---
### Author:  [@jmlord](https://meta.discourse.org/u/jmlord)
#### Post date: [February 13, 2024, 3:27pm UTC](https://meta.discourse.org/t/oauth2-plugin-avatar-not-used/295121/4 "2024-02-13T15:27:29Z")
Ok, I got it to work with the 2-step process. It seems that either the tooltip is wrong or that there is a bug with that part of the plugin:
> `oauth2 callback user info paths` : … Supported properties are name, username, email, email\_verified **and avatar**.
The latter is not true. For the avatars to work, one needs to add a json endpoint for user details, check “Fetch user JSON for OAuth2” and fill the `oauth2 json avatar path` property.