From 79d5874b3549bdad8c288ab42bcae065025fdb8e Mon Sep 17 00:00:00 2001
From: Chris <33393789+MrDeerly@users.noreply.github.com>
Date: Fri, 9 Feb 2024 10:27:23 +0100
Subject: [PATCH] fix(tokenExchange): use correct token type for userInfo
requests (#3336)
Signed-off-by: Chris H <33393789+MrDeerly@users.noreply.github.com>
---
connector/oidc/oidc.go | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/connector/oidc/oidc.go b/connector/oidc/oidc.go
index b125979b..e9486354 100644
--- a/connector/oidc/oidc.go
+++ b/connector/oidc/oidc.go
@@ -433,7 +433,10 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
// We immediately want to run getUserInfo if configured before we validate the claims.
// For token exchanges with access tokens, this is how we verify the token.
if c.getUserInfo {
- userInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(token))
+ userInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(&oauth2.Token{
+ AccessToken: token.AccessToken,
+ TokenType: "Bearer", // The UserInfo endpoint requires a bearer token as per RFC6750
+ }))
if err != nil {
return identity, fmt.Errorf("oidc: error loading userinfo: %v", err)
}
--
GitLab