fix: set iss from userinfo claims if missing (ory#3744)

pm17788 · Feb 7, 2024 · 241a911 · 241a911
1 parent 34751a1
commit 241a911
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/selfservice/strategy/oidc/provider_generic_oidc.go b/selfservice/strategy/oidc/provider_generic_oidc.go
@@ -164,6 +164,17 @@ func (g *ProviderGenericOIDC) claimsFromUserInfo(ctx context.Context, exchange *
 		return nil, errors.WithStack(herodot.ErrBadRequest.WithReason("sub (Subject) claim mismatch between ID token and UserInfo endpoint"))
 	}
 
+	// If signed, the UserInfo Response MUST contain the Claims iss (issuer) and aud
+	// (audience) as members. The iss value MUST be the OP's Issuer Identifier URL.
+	// The aud value MUST be or include the RP's Client ID value.
+	// See https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
+	//
+	// Consequently, the issuer might not be present in the UserInfo response and we
+	// need to set it here.
+	if claims.Issuer == "" {
+		claims.Issuer = idToken.Issuer
+	}
+
 	return &claims, nil
 }