From 50223e77449b87de6e1ad8e16c89e1bdc8dd2732 Mon Sep 17 00:00:00 2001
From: Jamie Klassen <jklassen@vmware.com>
Date: Mon, 27 Mar 2023 05:56:48 -0400
Subject: [PATCH] WIP: conditionally skip user profile

OIDC auth provider returns an empty user profile when the associated issuer has
no userinfo_endpoint. In theory this would enable access-delegation-only use
cases, but I haven't thought through all the consequences.

Signed-off-by: Jamie Klassen <jklassen@vmware.com>
---
 .../src/providers/oidc/provider.ts            | 24 ++++++++++++-------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
index 7638027b01..96bcbf6e00 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -130,7 +130,9 @@ export class OidcAuthProvider implements OAuthHandlers {
     if (!tokenset.access_token) {
       throw new Error('Refresh failed');
     }
-    const userinfo = await client.userinfo(tokenset.access_token);
+    const userinfo = client.issuer.userinfo_endpoint
+      ? await client.userinfo(tokenset.access_token)
+      : { sub: '' };
 
     return {
       response: await this.handleResult({ tokenset, userinfo }),
@@ -159,17 +161,23 @@ export class OidcAuthProvider implements OAuthHandlers {
       },
       (
         tokenset: TokenSet,
-        userinfo: UserinfoResponse,
-        done: PassportDoneCallback<OidcAuthResult, PrivateInfo>,
+        userinfo:
+          | UserinfoResponse
+          | PassportDoneCallback<OidcAuthResult, PrivateInfo>,
+        done?: PassportDoneCallback<OidcAuthResult, PrivateInfo>,
       ) => {
-        if (typeof done !== 'function') {
-          throw new Error(
-            'OIDC IdP must provide a userinfo_endpoint in the metadata response',
+        if (typeof userinfo === 'function') {
+          userinfo(
+            undefined,
+            { tokenset, userinfo: { sub: '' } },
+            {
+              refreshToken: tokenset.refresh_token,
+            },
           );
         }
-        done(
+        done!(
           undefined,
-          { tokenset, userinfo },
+          { tokenset, userinfo: userinfo as UserinfoResponse },
           {
             refreshToken: tokenset.refresh_token,
           },