Add support for querying userinfo-endpoint

[paulmillar]

It's perhaps not something everyone does, but one thing I find myself doing fairly often is querying an OP's user-info endpoint with a token.

This is just boiler-plate stuff: using openid-configuration to discover the user-info endpoint and calling this with a token.

Would it make sense for oidc-agent to provide an easy way to achieve this?

[marcvs]

I'm running this use case several times a day using flaat: https://github.com/indigo-dc/flaat

pip3 install flaat
flaat-userinfo `oidc-token egi `

[paulmillar]

flaat looks very useful, thanks @marcvs. However, doesn't this require the token to be a JWT? Otherwise it wouldn't be able to discover the user-info endpoint.

A benefit of doing this in collaboration with oidc-agent is that such a solution wouldn't need the token to be a JWT: oidc-agent knows the OP's discovery endpoint.

[zachmann]

We could integrate flaat with oidc-agent. This would allow:

• flaat gets the token directly from the agent -> easier syntax, e.g. flaat-userinfo --agent egi
• flaat gets the issuer url along with the token and therefore knows the issuer for sure, regardless of jwt or not.

The integration should be easy with the existing python lib and less effort than integrating it directly in the agent. Also thematically it fits much better to flaat.

[marcvs]

flaat looks very useful, thanks @marcvs. However, doesn't this require the token to be a JWT? Otherwise it wouldn't be able to discover the user-info endpoint.

Magic, knowledge and a threadpool combined result in non-JWT ATs to be tested against all known and trusted non-JWT-OPs ;)

[paulmillar]

Sure :-) dCache does something similar with non-JWT tokens.

Is the list of "all known and trusted non-JWT-OPs" something that comes with flaat, or something that the user has to provide?

[marcvs]

We could integrate flaat with oidc-agent. This would allow:

* flaat gets the token directly from the agent -> easier syntax, e.g. `flaat-userinfo --agent egi`

* flaat gets the issuer url along with the token and therefore knows the issuer for sure, regardless of jwt or not.

The integration should be easy with the existing python lib and less effort than integrating it directly in the agent. Also thematically it fits much better to flaat.

Ok; I've added support to flaat. That was extremely straightforward to use!!!!