element-hq / element-hq/synapse

OpenID Connect: UserInfo fetching fails if returned as jwt (using endpoint)

Open
#12,530 0 comments 0 reactions 0 assignees View on GitHub
A-SSO T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#12530](https://github.com/matrix-org/synapse/issues/12530).

---

### Description

I’m trying to use openid connect with synapse. The configured openid connect provider uses the user info endpoint to provide the user info (not the id token). The user info response contains a jwt (which contains the user info) and not a json directly. Requesting such a user info fails with an "Could not fetch userinfo" error (see below).

### Steps to reproduce

- configure oidc_provider with property "user_profile_method: "userinfo_endpoint"" and "scopes: ["openid",...]"
- use an oidc provider which returns the a jwt as response to the call of the user info endpoint
- Login with the configured oidc provider
- Home Server logs the following error:

```
2022-04-22 16:46:12,004 - synapse.handlers.oidc - 856 - ERROR - GET-3 - Could not fetch userinfo
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/synapse/handlers/oidc.py", line 854, in handle_oidc_callback
userinfo = await self._fetch_userinfo(token)
File "/usr/local/lib/python3.9/site-packages/synapse/handlers/oidc.py", line 655, in _fetch_userinfo
resp = await self._http_client.get_json(
File "/usr/local/lib/python3.9/site-packages/synapse/http/client.py", line 589, in get_json
return json_decoder.decode(body.decode("utf-8"))
File "/usr/local/lib/python3.9/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/local/lib/python3.9/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
```

The OpenID Connect spec defines (https://openid.net/specs/openid-connect-core-1_0.html#UserInfo):
_"If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt"_ which is the case for the respone.

Did I miss something or is this a bug/missing feature?

### Version information

- **Homeserver**:

If not matrix.org:
locally running

- **Version**:
{"server_version":"1.57.1","python_version":"3.9.12"}
- **Install method**:

git clone, locally build docker image
- **Platform**:

docker image on wsl ubuntu 20.04

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.