[BAEL-7339] Customize the OpenID Connect 1.0 UserInfo Response in Spring Authorization Server

spring-security-modules/spring-security-auth-server/src/main/java/com/baeldung/auth/server/customclaims/CustomClaimsAuthServerApplication.java

@@ -0,0 +1,14 @@
+package com.baeldung.auth.server.customclaims;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Import;
+
+@SpringBootApplication
+@Import(com.baeldung.auth.server.customclaims.config.AuthServerConfiguration.class)
+public class CustomClaimsAuthServerApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(CustomClaimsAuthServerApplication.class, args);
+    }
+}

spring-security-modules/spring-security-auth-server/src/main/java/com/baeldung/auth/server/customclaims/components/UserInfoMapper.java

@@ -0,0 +1,63 @@
+package com.baeldung.auth.server.customclaims.components;
+
+import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
+import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcUserInfoAuthenticationContext;
+
+import java.util.function.Function;
+
+public class UserInfoMapper implements Function<OidcUserInfoAuthenticationContext, OidcUserInfo> {
+
+    private final UserInfoService userInfoService;
+
+    public UserInfoMapper(UserInfoService userInfoService) {
+        this.userInfoService = userInfoService;
+    }
+
+    @Override
+    public OidcUserInfo apply(OidcUserInfoAuthenticationContext context) {
+
+        var subject = context.getAuthentication().getName();
+        var scopes = context.getAuthorization().getAuthorizedScopes();
+        var userInfo = userInfoService.getUserInfoByUsername(subject);
+
+        // Handle trivial cases first
+        if ( userInfo.isEmpty() || scopes.isEmpty() || (scopes.size() == 1 && scopes.contains("openid")) ) {
+            return OidcUserInfo.builder()
+              .subject(subject)
+              .build();
+        }
+
+        // Add claims based on the authorized scopes
+        var user = userInfo.get();
+        var b = OidcUserInfo.builder()
+          .subject(subject);
+
+        if ( scopes.contains("email") ) {
+            b.email(user.email())
+              .emailVerified(user.emailVerified());
+        }
+
+        if( scopes.contains("profile") ) {
+            b.name(user.name())
+              .givenName(user.givenName())
+              .familyName(user.familyName())
+              .locale(user.locale().toLanguageTag())
+              .gender(user.gender())
+              .birthdate(user.birthdate().toString())
+              .zoneinfo(user.zoneId().toString())
+              .preferredUsername(user.username())
+              .updatedAt(user.updatedAt().toString());
+        }
+
+        // Add custom claims only if authorized. Here, we'll use the "account" as an example
+        if ( scopes.contains("account") ) {
+            b.claim("account_id", user.accountId().toString())
+              .claim("created_at", user.createdAt().toString())
+              .claim("account_expires_at", user.accountExpiresAt().toString());
+        }
+
+        // Build the final result
+        return b.build();
+
+    }
+}

spring-security-modules/spring-security-auth-server/src/main/java/com/baeldung/auth/server/customclaims/components/UserInfoService.java

@@ -0,0 +1,54 @@
+package com.baeldung.auth.server.customclaims.components;
+
+import org.slf4j.Logger;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.*;
+
+@Service
+public class UserInfoService {
+
+    static final Map<String, UserInfo> users = Map.of(
+        "user", new UserInfo(
+        "user",
+        "Alice Smith",
+        "Alice",
+        "Smith",
+        "alice.smith@example.com",
+        true,
+        Locale.forLanguageTag("en-US"),
+        "female",
+        LocalDate.of(1990, 1, 1),
+        ZoneId.of("America/New_York"),
+        UUID.randomUUID(),
+        Instant.now(),
+        Instant.now(),
+        Instant.now().plus(60, java.time.temporal.ChronoUnit.DAYS)
+        )
+    );
+
+    public Optional<UserInfo> getUserInfoByUsername(String username) {
+        return Optional.ofNullable(users.get(username));
+    }
+
+    public record UserInfo(
+        String username,
+        String name,
+        String givenName,
+        String familyName,
+        String email,
+        boolean emailVerified,
+        Locale locale,
+        String gender,
+        LocalDate birthdate,
+        ZoneId zoneId,
+        UUID accountId,
+        Instant createdAt,
+        Instant updatedAt,
+        Instant accountExpiresAt
+    ) {}
+}

spring-security-modules/spring-security-auth-server/src/main/java/com/baeldung/auth/server/customclaims/config/AuthServerConfiguration.java

@@ -0,0 +1,92 @@
+package com.baeldung.auth.server.customclaims.config;
+
+import com.baeldung.auth.server.customclaims.components.UserInfoMapper;
+import com.baeldung.auth.server.customclaims.components.UserInfoService;
+import org.slf4j.Logger;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.security.autoconfigure.web.servlet.SecurityFilterProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.http.MediaType;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
+import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcUserInfoAuthenticationContext;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
+import org.springframework.security.web.util.matcher.MediaTypeRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+
+import java.util.List;
+import java.util.Set;
+import java.util.function.Function;
+
+import static org.springframework.security.config.Customizer.withDefaults;
+
+@Configuration
+public class AuthServerConfiguration {
+    private static final Logger log = org.slf4j.LoggerFactory.getLogger(AuthServerConfiguration.class);
+
+    private final UserInfoService userInfoService;
+
+    @Value("${customuserinfo.enabled:true}")
+    private boolean enableCustomUserInfo = true;
+
+    public AuthServerConfiguration(UserInfoService userInfoService) {
+        this.userInfoService = userInfoService;
+    }
+
+    @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE)
+    SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http, UserInfoMapper userInfoMapper) {
+
+        // @formatter:off
+        return http.oauth2AuthorizationServer(sas -> {
+          http
+            .securityMatcher(sas.getEndpointsMatcher())
+            .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
+            .exceptionHandling(exceptions ->
+              exceptions.defaultAuthenticationEntryPointFor(new LoginUrlAuthenticationEntryPoint("/login"), createRequestMatcher()));
+
+          if ( enableCustomUserInfo ) {
+            sas.oidc(oidc -> oidc
+              .userInfoEndpoint(userInfo -> userInfo
+                .userInfoMapper(userInfoMapper)));
+          }
+          else {
+            sas.oidc(withDefaults());
+          }
+        }).build();
+        // @formatter:on
+    }
+
+    @Bean
+    UserInfoMapper userInfoMapper() {
+        return new UserInfoMapper(userInfoService);
+    }
+
+    @Bean
+    @Order(SecurityFilterProperties.BASIC_AUTH_ORDER)
+    SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) {
+        // @formatter:off
+        http
+          .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated())
+          .formLogin(withDefaults());
+        // @formatter:on
+        return http.build();
+    }
+
+    private static RequestMatcher createRequestMatcher() {
+        MediaTypeRequestMatcher requestMatcher = new MediaTypeRequestMatcher(MediaType.TEXT_HTML);
+        requestMatcher.setIgnoredMediaTypes(Set.of(MediaType.ALL));
+        return requestMatcher;
+    }
+
+}
+
+

spring-security-modules/spring-security-auth-server/src/main/resources/application-customclaims.yaml

@@ -0,0 +1,28 @@
+spring:
+  security:
+    user:
+      name: user
+      password: "{noop}password"
+    oauth2:
+      authorizationserver:
+        client:
+          client1:
+            require-proof-key: false
+            require-authorization-consent: false
+            registration:
+              client-name: "Client 1 - Issuer 1"
+              client-id: client1
+              client-secret: "{noop}secret1"
+              client-authentication-methods:
+                - client_secret_basic
+              redirect-uris:
+                - http://localhost:9090/login/oauth2/code/issuer1client1
+              authorization-grant-types:
+                - authorization_code
+                - refresh_token
+              scopes:
+                - openid
+                - email
+                - profile
+                - account
+