Add sub to OIDC user info response

According to the specs sub (subject, user id) is a mandatory claim in the user info response.
EreMaijala · Oct 1, 2024 · 71a44d0 · 71a44d0
1 parent 0ee7d2b
commit 71a44d0
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/module/VuFind/src/VuFind/Controller/OAuth2Controller.php b/module/VuFind/src/VuFind/Controller/OAuth2Controller.php
@@ -278,8 +278,9 @@ public function userInfoAction()
                     OAuthServerException::accessDenied('User does not exist anymore')
                 );
             }
-            $result = $this->claimExtractor
-                ->extract($scopes, $userEntity->getClaims());
+            $result = $this->claimExtractor->extract($scopes, $userEntity->getClaims());
+            // The sub claim must always be returned:
+            $result['sub'] = $userId;
             return $this->getJsonResponse($result);
         } catch (OAuthServerException $e) {
             return $this->handleOAuth2Exception('User info request', $e);

diff --git a/module/VuFind/tests/integration-tests/src/VuFindTest/Mink/OAuth2Test.php b/module/VuFind/tests/integration-tests/src/VuFindTest/Mink/OAuth2Test.php
@@ -276,6 +276,7 @@ public function testOAuth2Authorization(): void
         );
 
         $userInfo = json_decode($response->getBody(), true);
+        $this->assertEquals($idToken->sub, $userInfo['sub']);
         $this->assertEquals($nonce, $userInfo['nonce']);
         $this->assertEquals('Tester McTestenson', $userInfo['name']);
         $this->assertEquals('Tester', $userInfo['given_name']);