search

ajmyyra / ambassador-auth-oidc

OpenID Connect AuthService for Ambassador API Gateway
MIT License
88 stars 35 forks source link

Make the userinfo endpoint optional #14

Closed yanniszark closed 5 years ago

yanniszark commented 5 years ago

I have discovered that there is some confusion around the userinfo_endpoint and whether it's mandatory or not. Dex, a big project around OIDC, doesn't seem to implement it yet and I have found references to the spec that characterize it as RECOMMENDED.

Because of the Dex use-case and also the fact that the userinfo endpoint doesn't seem to be mandatory, it makes sense to provide a flag to allow getting the claims from the id_token instead of the userinfo endpoint.

cc @ajmyyra

ajmyyra commented 5 years ago

Yup, userinfo doesn't seem to be mandatory, only recommended. Thank you for pointing this out! I hadn't run across any software that wouldn't offer it, but as Dex is widely-used, supporting it is of course needed. I'll go through the PR and merge it soon.