From 7440319aa222df210cd7edad9207f28099d80f0c Mon Sep 17 00:00:00 2001 From: Chris H <33393789+MrDeerly@users.noreply.github.com> Date: Wed, 7 Feb 2024 15:55:19 +0100 Subject: [PATCH] fix(tokenExchange): use correct token type for userInfo requests Signed-off-by: Chris H <33393789+MrDeerly@users.noreply.github.com> --- connector/oidc/oidc.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/connector/oidc/oidc.go b/connector/oidc/oidc.go index b125979b99..e948635442 100644 --- a/connector/oidc/oidc.go +++ b/connector/oidc/oidc.go @@ -433,7 +433,10 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I // We immediately want to run getUserInfo if configured before we validate the claims. // For token exchanges with access tokens, this is how we verify the token. if c.getUserInfo { - userInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(token)) + userInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(&oauth2.Token{ + AccessToken: token.AccessToken, + TokenType: "Bearer", // The UserInfo endpoint requires a bearer token as per RFC6750 + })) if err != nil { return identity, fmt.Errorf("oidc: error loading userinfo: %v", err) }