OpenIdConnectEventHandler - enable UserInfo JWT-validation.

[marcusber]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

Related to #4650 (Decrypt UserInfo-response).

I would like to validate the JWT retrieved from the UserInfo-endpoint. The response I'm dealing with is not encrypted so the payload could be read, but I would also like to validate the response before continuing.
My workaround is similar to #4650

Describe the solution you'd like

It would be nice to be able to implement callback events from the existing handler to be able to validate the JWT (if it shouldn't be validated at all times, with an opt-out flag in Options and validation handled in the handler itself).

Additional context

A local keykloak server could be configured to sign UserInfo-response JWT and I believe also encrypt the JWT if you also would like to fit #4650 into the solution when developing.

[halter73]

Thanks for filing this issue. I do think #4650 should prioritized ahead of this since a new event prior to parsing the UserInfo response would allow for both handling encrypted JWTs and validating signed JWTs without any breaking changes.

I agree this is not a duplicate of that issue considering you would like at least the option to validate the UserInfo JWT automatically. I suspect we would make this opt-in rather than opt-out, however. We don't even validate the id token signature in the authorization code flow. See here for where it's skipped.

Given that the UserInfo endpoint is protected by TLS, and you're presumably solely relying on TLS to ensure the validity of the .well-known/openid-configuration endpoint, jwks_uri, etc., is there a particular reason the UserInfo response needs an extra layer of validation?

[marcusber]

@halter73 It was a requirement from the IDP. I don't know the reason behind it.

[halter73]

If it's a hard requirement, I think your best bet until we address this issue would be to leave GetClaimsFromUserInfoEndpoint false but set SaveTokens to true. Then after successfully signing in, you could make a request to the userinfo_endpoint yourself using HttpClient with the saved access token. Then you could do any validation of the response you want before reading whatever claims you need and reissuing the cookie.

[marcusber]

Thanks for the suggestion.