OAuth2UserService supports signed and/or encrypted UserInfo Response

Expected Behavior

The implementations of OAuth2UserService support the application/jwt content type when fetching the UserInfo resource.

Related Spec Info:

If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt.

OpenID Connect Core 1.0 - 5.3.2. Successful UserInfo Response

Current Behavior

The implementations of OAuth2UserService are DefaultOAuth2UserService and OidcUserService. These implementations only support the application/json content type when fetching the UserInfo resource. Resulting in 406 Not Acceptable when the given identity provider only allows application/jwt or this error when provided with a custom restOperations which allows application/jwt:

https://github.com/spring-projects/spring-security/blob/eff4cdc9241d264376e06ce0117c5a6715f77094/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java#L139-L147

Context

The identity provider we have to use is build with "high security in mind" and forces the use of signed JWT.

More in depth information and a workaround I found while developing: https://stackoverflow.com/questions/59876435/spring-fails-for-userinfo-endpoint-returning-signed-jwt

Start with DefaultOAuth2UserService.java at the linked UserInfo request code, then compare OidcUserService and how both implementations process UserInfo responses. Trace the handling of application/json and application/jwt, and use the OpenID Connect UserInfo specification to define the expected behavior. Done means both services support the specified signed or encrypted UserInfo response without the reported 406 error.