After successfully exchanging the token using token exchange, calling the userinfo endpoint reports invalid_token

[chenzhenjia]

Expected Behavior
The userinfo endpoint should return user information successfully after a token exchange, using the valid access token.

Current Behavior
When calling the userinfo endpoint after a successful token exchange, an invalid_token error is returned.

Context
This issue affects the ability to retrieve user information after a token exchange.

OAuth2Authorization.Token<OidcIdToken> idToken = authorization.getToken(OidcIdToken.class);
if (idToken == null) {
    throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN);
}

[malvinpatrick]

What is token type you are using ? Is it REFERENCE token or SELF_CONTAINED token ? Because I have an issue with REFERENCE token when I need to call /userinfo. AuthenticationProvider always use JWTAuthenticationProvider to validate my access token, as #1865 mentioned.

[chenzhenjia]

What is token type you are using ? Is it REFERENCE token or SELF_CONTAINED token ? Because I have an issue with REFERENCE token when I need to call /userinfo. AuthenticationProvider always use JWTAuthenticationProvider to validate my access token, as #1865 mentioned.

It has nothing to do with the REFERENCE token or the SELF_CONTAINED token. The token exchange does not save the idToken, which causes the userinfo to be unable to obtain the idToken and report an error.

[malvinpatrick]

I think you have missed configuration. Or you mis about user logged in or client doesn’t have ‘openid’ scope. Because IDToken only generate when user and client have openid scope.

[jgrandja]

@chenzhenjia Can you please provide more details on your use case. Why are you performing a token exchange using the access token provided by the OpenID authentication flow? Why can't you use the original access token to call /userinfo endpoint?

[chenzhenjia]

@jgrandja Because the scope is inconsistent, token exchange is required, but userinfo still needs to be called after exchanging the token

[jgrandja]

@chenzhenjia

Because the scope is inconsistent, token exchange is required, but userinfo still needs to be called after exchanging the token

I don't quite understand your reason why you need to call the /userinfo endpoint with the new "exchanged" access token.

Either way, the original access token MUST be used when calling the /userinfo endpoint since it's associated with the OAuth2Authorization that contains the OidcIdToken and it's used when determining which claims to return in the UserInfo response

spring-authorization-server/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcUserInfoAuthenticationProvider.java

Line 193 in b76300b

OidcIdToken idToken = authorization.getToken(OidcIdToken.class).getToken();

The OAuth2Authorization associated with the new "exchanged" access token should not be used to call the /userinfo endpoint since it's not the original access token granted in the OIDC Authentication flow and therefore it will not contain the OidcIdToken.