Identify the invalid 'sub' value and reject the UserInfo Response.

[duttarnab]

Make a UserInfo Request and verify the 'sub' value of the UserInfo Response by comparing it with the ID Token's 'sub' value. Identify the invalid 'sub' value and reject the UserInfo Response.

Parent Ticket: #437

[duttarnab]

Done in 4.2

[duttarnab]

@yuriyz , for completing this Conformance test case we need id_token at getUserInfo command so that id_token sub value can be compared with userInfo sub value.
I was taking id_token from Rp store in oxd (which I think is not the proper way). But for Implicit flow (id_token, token) id_token is not stored in Rp in oxd (since getTokenByCode command is not called in Implicit flow.)

Please advise how we can get id_token in getUserInfo command in oxd.

And Conformance OP does not have introspection end-point.

[yuriyz]

oxd was designed as backchannel app. Sockets are removed long time ago and HTTP is main transport now. Thus it's time for oxd to have direct /authorize command instead of /get-authorization-url and /get-tokens-by-code. oxd as RP should completely handle Connect work for client application that is using oxd. I've created ticket to improve that part here #462.

So if back to your question with current oxd design the only way is to add additional OPTIONAL id_token parameter to /get-user-info which must be removed after #462 is done and with next major release (to not break backward compatibility in minor release). If id_token is present then validate user info response against it. If it's not provided then skip validation. Add configuration property validateUserInfoWithIdToken: false. If it's set to true and id_token is not provided then return error.

[duttarnab]

Done in 4.2