httpd: add OIDC option to read claims from the UserInfo endpoint

With query_userinfo enabled, the UserInfo endpoint is queried after
authentication and the user claims are read from both sources. Claims
from the verified ID token take precedence on conflicts, empty values
do not override, and the UserInfo subject must match the ID token
subject. The option is validated at startup against the provider
metadata.

Reading the claims from the UserInfo endpoint was requested in #2265
and an implementation, enabled by default and with the opposite claim
precedence, was proposed in #2266.

Fixes #2265
Closes #2266

Suggested-by: TEC <git@tecosaur.net>

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>

Author: drakkan

internal/config/config.go

@@ -133,6 +133,7 @@ var (
 			ImplicitRoles:              false,
 			Scopes:                     []string{"openid", "profile", "email"},
 			CustomFields:               []string{},
+			QueryUserInfo:              false,
 			InsecureSkipSignatureCheck: false,
 			Debug:                      false,
 		},
@@ -1676,6 +1677,12 @@ func getHTTPDOIDCFromEnv(idx int) (httpd.OIDC, bool) {
 		isSet = true
 	}
 
+	queryUserInfo, ok := lookupBoolFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__OIDC__QUERY_USERINFO", idx))
+	if ok {
+		result.QueryUserInfo = queryUserInfo
+		isSet = true
+	}
+
 	skipSignatureCheck, ok := lookupBoolFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__OIDC__INSECURE_SKIP_SIGNATURE_CHECK", idx))
 	if ok {
 		result.InsecureSkipSignatureCheck = skipSignatureCheck

internal/config/config_test.go

@@ -1222,6 +1222,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
 	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__IMPLICIT_ROLES", "1")
 	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__CUSTOM_FIELDS", "field1,field2")
 	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__INSECURE_SKIP_SIGNATURE_CHECK", "1")
+	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__QUERY_USERINFO", "1")
 	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__DEBUG", "1")
 	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__ENABLED", "true")
 	os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__ALLOWED_HOSTS", "*.example.com,*.example.net")
@@ -1294,6 +1295,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
 		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__IMPLICIT_ROLES")
 		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__CUSTOM_FIELDS")
 		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__INSECURE_SKIP_SIGNATURE_CHECK")
+		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__QUERY_USERINFO")
 		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__OIDC__DEBUG")
 		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__ENABLED")
 		os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__ALLOWED_HOSTS")
@@ -1353,6 +1355,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
 	require.Equal(t, 0, bindings[0].ClientIPHeaderDepth)
 	require.Len(t, bindings[0].OIDC.Scopes, 3)
 	require.False(t, bindings[0].OIDC.InsecureSkipSignatureCheck)
+	require.False(t, bindings[0].OIDC.QueryUserInfo)
 	require.False(t, bindings[0].OIDC.Debug)
 	require.Empty(t, bindings[0].Security.ReferrerPolicy)
 	require.Equal(t, 8000, bindings[1].Port)
@@ -1373,6 +1376,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
 	require.Empty(t, bindings[1].OIDC.ClientID)
 	require.Len(t, bindings[1].OIDC.Scopes, 3)
 	require.False(t, bindings[1].OIDC.InsecureSkipSignatureCheck)
+	require.False(t, bindings[1].OIDC.QueryUserInfo)
 	require.False(t, bindings[1].OIDC.Debug)
 	require.False(t, bindings[1].Security.Enabled)
 	require.Equal(t, "Web Admin", bindings[1].Branding.WebAdmin.Name)
@@ -1420,6 +1424,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
 	require.Equal(t, "field1", bindings[2].OIDC.CustomFields[0])
 	require.Equal(t, "field2", bindings[2].OIDC.CustomFields[1])
 	require.True(t, bindings[2].OIDC.InsecureSkipSignatureCheck)
+	require.True(t, bindings[2].OIDC.QueryUserInfo)
 	require.True(t, bindings[2].OIDC.Debug)
 	require.True(t, bindings[2].Security.Enabled)
 	require.Len(t, bindings[2].Security.AllowedHosts, 2)

internal/httpd/httpd_test.go

@@ -27677,10 +27677,23 @@ func startOIDCMockServer() {
 		http.HandleFunc("/", func(w http.ResponseWriter, _ *http.Request) {
 			fmt.Fprintf(w, "OK\n")
 		})
+		http.HandleFunc("/auth/realms/sftpgo/protocol/openid-connect/userinfo", func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			if r.Header.Get("Authorization") == "Bearer 500" {
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			fmt.Fprintf(w, `{"sub":"123","preferred_username":"oidc_user","email":"example@example.com","sftpgo_role":"admin"}`)
+		})
 		http.HandleFunc("/auth/realms/sftpgo/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set("Content-Type", "application/json")
 			fmt.Fprintf(w, `{"issuer":"http://127.0.0.1:11111/auth/realms/sftpgo","authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/auth","token_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token","introspection_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token/introspect","userinfo_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/userinfo","end_session_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/logout","frontchannel_logout_session_supported":true,"frontchannel_logout_supported":true,"jwks_uri":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/certs","check_session_iframe":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/login-status-iframe.html","grant_types_supported":["authorization_code","implicit","refresh_token","password","client_credentials","urn:ietf:params:oauth:grant-type:device_code","urn:openid:params:grant-type:ciba"],"response_types_supported":["code","none","id_token","token","id_token token","code id_token","code token","code id_token token"],"subject_types_supported":["public","pairwise"],"id_token_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"id_token_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"id_token_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"userinfo_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"request_object_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"request_object_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"request_object_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"response_modes_supported":["query","fragment","form_post","query.jwt","fragment.jwt","form_post.jwt","jwt"],"registration_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/clients-registrations/openid-connect","token_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"token_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"introspection_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"introspection_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"authorization_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"claims_supported":["aud","sub","iss","auth_time","name","given_name","family_name","preferred_username","email","acr"],"claim_types_supported":["normal"],"claims_parameter_supported":true,"scopes_supported":["openid","phone","email","web-origins","offline_access","microprofile-jwt","profile","address","roles"],"request_parameter_supported":true,"request_uri_parameter_supported":true,"require_request_uri_registration":true,"code_challenge_methods_supported":["plain","S256"],"tls_client_certificate_bound_access_tokens":true,"revocation_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/revoke","revocation_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"revocation_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"backchannel_logout_supported":true,"backchannel_logout_session_supported":true,"device_authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/auth/device","backchannel_token_delivery_modes_supported":["poll","ping"],"backchannel_authentication_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/ciba/auth","backchannel_authentication_request_signing_alg_values_supported":["PS384","ES384","RS384","ES256","RS256","ES512","PS256","PS512","RS512"],"require_pushed_authorization_requests":false,"pushed_authorization_request_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/par/request","mtls_endpoint_aliases":{"token_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token","revocation_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/revoke","introspection_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token/introspect","device_authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/auth/device","registration_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/clients-registrations/openid-connect","userinfo_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/userinfo","pushed_authorization_request_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/par/request","backchannel_authentication_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/ciba/auth"}}`)
 		})
+		// realm without a userinfo endpoint
+		http.HandleFunc("/auth/realms/sftpgo2/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			fmt.Fprintf(w, `{"issuer":"http://127.0.0.1:11111/auth/realms/sftpgo2","authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo2/protocol/openid-connect/auth","token_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo2/protocol/openid-connect/token","jwks_uri":"http://127.0.0.1:11111/auth/realms/sftpgo2/protocol/openid-connect/certs","response_types_supported":["code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"]}`)
+		})
 		http.HandleFunc("/404", func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusNotFound)
 			fmt.Fprintf(w, "Not found\n")

internal/httpd/oidc.go

@@ -95,6 +95,11 @@ type OIDC struct {
 	Scopes []string `json:"scopes" mapstructure:"scopes"`
 	// Custom token claims fields to pass to the pre-login hook
 	CustomFields []string `json:"custom_fields" mapstructure:"custom_fields"`
+	// QueryUserInfo defines whether to query the UserInfo endpoint after
+	// authentication and read the user claims from both sources.
+	// ID token claims take precedence over UserInfo claims with the same name.
+	// The UserInfo subject must match the ID token subject.
+	QueryUserInfo bool `json:"query_userinfo" mapstructure:"query_userinfo"`
 	// InsecureSkipSignatureCheck causes SFTPGo to skip JWT signature validation.
 	// It's intended for special cases where providers, such as Azure, use the "none"
 	// algorithm. Skipping the signature validation can cause security issues
@@ -172,6 +177,9 @@ func (o *OIDC) initialize() error {
 			logger.Debug(logSender, "", "oidc end session endpoint %q", o.providerLogoutURL)
 		}
 	}
+	if o.QueryUserInfo && provider.UserInfoEndpoint() == "" {
+		return errors.New("oidc: query_userinfo is enabled but the provider has no userinfo endpoint")
+	}
 	o.provider = provider
 	o.verifier = nil
 	o.oauth2Config = &oauth2.Config{
@@ -284,6 +292,42 @@ func (t *oidcToken) parseClaims(claims map[string]any, usernameField, roleField
 	return nil
 }
 
+// mergeOIDCClaims returns the UserInfo claims overlaid with the verified ID
+// token claims, so the signed token wins on conflicts. Claims describing the
+// authentication event are read from the ID token only. Null, empty string
+// and empty array values are dropped from both sources: OIDC Core 5.3.2
+// requires omitting unreturned claims instead of setting them to null or empty.
+func mergeOIDCClaims(idTokenClaims, userInfoClaims map[string]any) map[string]any {
+	merged := make(map[string]any, len(idTokenClaims)+len(userInfoClaims))
+	for k, v := range userInfoClaims {
+		switch k {
+		case "sid", "auth_time", "nonce":
+			continue
+		}
+		if isEmptyOIDCClaim(v) {
+			continue
+		}
+		merged[k] = v
+	}
+	for k, v := range idTokenClaims {
+		if isEmptyOIDCClaim(v) {
+			continue
+		}
+		merged[k] = v
+	}
+	return merged
+}
+
+func isEmptyOIDCClaim(v any) bool {
+	if v == nil || v == "" {
+		return true
+	}
+	if s, ok := v.([]any); ok && len(s) == 0 {
+		return true
+	}
+	return false
+}
+
 func (t *oidcToken) getRoleFromField(claims map[string]any, roleField string) {
 	role, ok := getOIDCFieldFromClaims(claims, roleField)
 	if ok {
@@ -710,6 +754,36 @@ func (s *httpdServer) handleOIDCRedirect(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	s.debugTokenClaims(claims, rawIDToken)
+	if s.binding.OIDC.QueryUserInfo {
+		userInfo, err := s.binding.OIDC.provider.UserInfo(ctx, oauth2.StaticTokenSource(oauth2Token))
+		if err != nil {
+			logger.Warn(logSender, "", "unable to query the user info endpoint: %v", err)
+			setFlashMessage(w, r, newFlashMessage("Unable to query the OpenID user info endpoint", util.I18nOIDCErrTokenExchange))
+			doRedirect()
+			doLogout(rawIDToken)
+			return
+		}
+		if userInfo.Subject != idToken.Subject {
+			logger.Debug(logSender, "", "user info subject %q does not match the id token subject %q",
+				userInfo.Subject, idToken.Subject)
+			setFlashMessage(w, r, newFlashMessage("User info subject does not match the ID token subject", util.I18nOIDCTokenInvalid))
+			doRedirect()
+			doLogout(rawIDToken)
+			return
+		}
+		userInfoClaims := make(map[string]any)
+		if err := userInfo.Claims(&userInfoClaims); err != nil {
+			logger.Debug(logSender, "", "unable to get user info claims: %v", err)
+			setFlashMessage(w, r, newFlashMessage("Unable to get OpenID user info claims", util.I18nOIDCTokenInvalid))
+			doRedirect()
+			doLogout(rawIDToken)
+			return
+		}
+		claims = mergeOIDCClaims(claims, userInfoClaims)
+		if s.binding.OIDC.Debug {
+			logger.Debug(logSender, "", "claims after user info merge %+v", claims)
+		}
+	}
 	token := oidcToken{
 		AccessToken:  oauth2Token.AccessToken,
 		TokenType:    oauth2Token.TokenType,