Enforce the access token has an openid scope for the UserInfo endpoint
@@ -32,12 +32,14 @@ import org.apache.cxf.rs.security.jose.jwt.JwtToken;
import org.apache.cxf.rs.security.jose.jwt.JwtUtils;
import org.apache.cxf.rs.security.oauth2.common.Client;
import org.apache.cxf.rs.security.oauth2.common.OAuthContext;
+import org.apache.cxf.rs.security.oauth2.common.OAuthPermission;
import org.apache.cxf.rs.security.oauth2.provider.OAuthDataProvider;
import org.apache.cxf.rs.security.oauth2.provider.OAuthServerJoseJwtProducer;
import org.apache.cxf.rs.security.oauth2.utils.OAuthContextUtils;
import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
import org.apache.cxf.rs.security.oidc.common.IdToken;
import org.apache.cxf.rs.security.oidc.common.UserInfo;
+import org.apache.cxf.rs.security.oidc.utils.OidcUtils;
@Path("/userinfo")
public class UserInfoService extends OAuthServerJoseJwtProducer {
@@ -51,6 +53,14 @@ public class UserInfoService extends OAuthServerJoseJwtProducer {
@Produces({"application/json", "application/jwt" })
public Response getUserInfo() {
OAuthContext oauth = OAuthContextUtils.getContext(mc);
+
+ // Check the access token has the "openid" scope
+ if (!oauth.getPermissions().stream()
+ .map(OAuthPermission::getPermission)
+ .anyMatch(OidcUtils.OPENID_SCOPE::equals)) {
+ Response.status(401);
+ }
+
UserInfo userInfo = null;
if (userInfoProvider != null) {
userInfo = userInfoProvider.getUserInfo(oauth.getClientId(), oauth.getSubject(),
