element-hq / element-hq/synapse
OpenID Connect: UserInfo fetching fails if returned as jwt (using endpoint)
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#12530](https://github.com/matrix-org/synapse/issues/12530).
---
### Description
I’m trying to use openid connect with synapse. The configured openid connect provider uses the user info endpoint to provide the user info (not the id token). The user info response contains a jwt (which contains the user info) and not a json directly. Requesting such a user info fails with an "Could not fetch userinfo" error (see below).
### Steps to reproduce
- configure oidc_provider with property "user_profile_method: "userinfo_endpoint"" and "scopes: ["openid",...]"
- use an oidc provider which returns the a jwt as response to the call of the user info endpoint
- Login with the configured oidc provider
- Home Server logs the following error:
```
2022-04-22 16:46:12,004 - synapse.handlers.oidc - 856 - ERROR - GET-3 - Could not fetch userinfo
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/synapse/handlers/oidc.py", line 854, in handle_oidc_callback
userinfo = await self._fetch_userinfo(token)
File "/usr/local/lib/python3.9/site-packages/synapse/handlers/oidc.py", line 655, in _fetch_userinfo
resp = await self._http_client.get_json(
File "/usr/local/lib/python3.9/site-packages/synapse/http/client.py", line 589, in get_json
return json_decoder.decode(body.decode("utf-8"))
File "/usr/local/lib/python3.9/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/local/lib/python3.9/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
```
The OpenID Connect spec defines (https://openid.net/specs/openid-connect-core-1_0.html#UserInfo):
_"If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt"_ which is the case for the respone.
Did I miss something or is this a bug/missing feature?
### Version information
- **Homeserver**:
If not matrix.org:
locally running
- **Version**:
{"server_version":"1.57.1","python_version":"3.9.12"}
- **Install method**:
git clone, locally build docker image
- **Platform**:
docker image on wsl ubuntu 20.04
Contributor guide
Assessment
This issue has not been assessed yet.