OAuthgrant filter does not work with GET /userinfo as the tokeninfo URL

[czhou-brex]

Describe the bug
The OAuthgrant filter requires a tokeninfo URL which is only called by a GET request. However some IDPs like Okta have already deprecated this call. Specifically it looks for a uid field and it it fails, it will do a redirect. This leads to a redirect loop.

Using the GET /userinfo does not resolve this issue, as in Okta's case specifically the uid field does not exist in GET /userinfo. https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/OrgAS/#tag/OrgAS/operation/userinfo

To Reproduce

skipper \
  -routes-file oauth.eskip \
  -enable-oauth2-grant-flow \
  -oauth2-auth-url https://myapp/oauth2/default/v1/authorize \
  -oauth2-token-url https://myapp/oauth2/default/v1/token \
  -oauth2-tokeninfo-url https://myapp/oauth2/default/v1/userinfo \
  -oauth2-secret-file=skipper-secrets \
  -oauth2-client-id=client-id \
  -oauth2-client-secret=client-secret \
  -oauth2-callback-path=/oauth/callback \
  -oauth2-auth-url-parameters=scope="openid profile offline_access" \
  -application-log-level DEBUG

oauth.eskip file
dashboard: * -> oauthGrant() -> inlineContent("It works!") -> <shunt>;

Expected behavior

• should successfully complete the oauth2 login

Observed behavior

• infinite loop caused by missing "uid" from calling GET /tokeninfo
  Failed to create token container: tokeninfo subject key 'uid' is missing.

I think it should not rely on the uid field and work with GET /userinfo like the oidc filter.

[AlexanderYastrebov]

Hello.

There is a -oauth2-tokeninfo-subject-key flag:

skipper/config/config.go

Line 497 in bd87e31

flag.StringVar(&cfg.Oauth2TokeninfoSubjectKey, "oauth2-tokeninfo-subject-key", "uid", "sets the tokeninfo subject key")

Could you please try -oauth2-tokeninfo-subject-key=sub (or nickname or email) and see if it helps?

[AlexanderYastrebov]

I also think this

skipper/filters/auth/grant.go

Line 166 in bd87e31

tokeninfo["sub"] = subject

should be set only when TokeninfoSubjectKey is not empty

skipper/filters/auth/grant.go

Lines 158 to 164 in bd87e31

	if f.config.TokeninfoSubjectKey != "" {
	if s, ok := tokeninfo[f.config.TokeninfoSubjectKey].(string); ok {
	subject = s
	} else {
	return fmt.Errorf("tokeninfo subject key '%s' is missing", f.config.TokeninfoSubjectKey)
	}
	}

such that existing sub claim is not overwritten when -oauth2-tokeninfo-subject-key=''

[czhou-brex]

Hello.

There is a -oauth2-tokeninfo-subject-key flag:

skipper/config/config.go

Line 497 in bd87e31

flag.StringVar(&cfg.Oauth2TokeninfoSubjectKey, "oauth2-tokeninfo-subject-key", "uid", "sets the tokeninfo subject key")

Could you please try -oauth2-tokeninfo-subject-key=sub (or nickname or email) and see if it helps?

Yes, this worked with the Okta GET /userinfo endpoint.