connector/oidc: allow overriding userinfo and device auth URLs (#4897)

The OIDC connector can already override the token, auth and JWKS URLs
discovered from .well-known/openid-configuration, but not the userinfo
or device authorization endpoints. This is a problem when a provider
advertises those endpoints incorrectly (e.g. https where only http is
reachable) and the discovery document can't be changed.

Add userInfoURL and deviceAuthURL to providerDiscoveryOverrides and
apply them in getProvider, mirroring the existing overrides.

Closes #4110

Signed-off-by: Kunalbehbud <b.kunal2002@gmail.com>

Author: Kunalbehbud

connector/oidc/oidc.go

@@ -136,13 +136,19 @@ type ProviderDiscoveryOverrides struct {
 	// JWKSURL provides a way to user overwrite the JWKS URL
 	// from the .well-known/openid-configuration jwks_uri
 	JWKSURL string `json:"jwksURL"`
+	// UserInfoURL provides a way to override the UserInfo URL
+	// from the .well-known/openid-configuration userinfo_endpoint
+	UserInfoURL string `json:"userInfoURL"`
+	// DeviceAuthURL provides a way to override the Device Authorization URL
+	// from the .well-known/openid-configuration device_authorization_endpoint
+	DeviceAuthURL string `json:"deviceAuthURL"`
 	// EndSessionURL provides a way to override the end_session_endpoint
 	// from the .well-known/openid-configuration
 	EndSessionURL string `json:"endSessionURL"`
 }
 
 func (o *ProviderDiscoveryOverrides) Empty() bool {
-	return o.TokenURL == "" && o.AuthURL == "" && o.JWKSURL == "" && o.EndSessionURL == ""
+	return o.TokenURL == "" && o.AuthURL == "" && o.JWKSURL == "" && o.UserInfoURL == "" && o.DeviceAuthURL == "" && o.EndSessionURL == ""
 }
 
 func getProvider(ctx context.Context, issuer string, overrides ProviderDiscoveryOverrides) (*oidc.Provider, error) {
@@ -186,6 +192,12 @@ func getProvider(ctx context.Context, issuer string, overrides ProviderDiscovery
 	if overrides.JWKSURL != "" {
 		config.JWKSURL = overrides.JWKSURL
 	}
+	if overrides.UserInfoURL != "" {
+		config.UserInfoURL = overrides.UserInfoURL
+	}
+	if overrides.DeviceAuthURL != "" {
+		config.DeviceAuthURL = overrides.DeviceAuthURL
+	}
 	return config.NewProvider(context.Background()), nil
 }
 

connector/oidc/oidc_test.go

@@ -833,6 +833,42 @@ func TestProviderOverride(t *testing.T) {
 			t.Fatalf("unexpected token URL: %s, expected: %s\n", conn.provider.Endpoint().TokenURL, expToken)
 		}
 	})
+
+	t.Run("Override userinfo and device auth URLs", func(t *testing.T) {
+		// A second server whose userinfo endpoint returns a distinct subject,
+		// so we can prove the overridden endpoint (not the discovery default)
+		// is the one actually used.
+		overrideServer, err := setupServer(map[string]any{"sub": "override-sub"}, true)
+		if err != nil {
+			t.Fatal("failed to setup override server", err)
+		}
+		defer overrideServer.Close()
+
+		conn, err := newConnector(Config{
+			Issuer: testServer.URL,
+			Scopes: []string{"openid", "groups"},
+			ProviderDiscoveryOverrides: ProviderDiscoveryOverrides{
+				DeviceAuthURL: "/test-device",
+				UserInfoURL:   fmt.Sprintf("%s/userinfo", overrideServer.URL),
+			},
+		})
+		if err != nil {
+			t.Fatal("failed to create new connector", err)
+		}
+
+		expDevice := "/test-device"
+		if conn.provider.Endpoint().DeviceAuthURL != expDevice {
+			t.Fatalf("unexpected device auth URL: %s, expected: %s\n", conn.provider.Endpoint().DeviceAuthURL, expDevice)
+		}
+
+		userInfo, err := conn.provider.UserInfo(context.Background(), oauth2.StaticTokenSource(&oauth2.Token{AccessToken: "sometoken"}))
+		if err != nil {
+			t.Fatal("failed to call UserInfo", err)
+		}
+		if userInfo.Subject != "override-sub" {
+			t.Fatalf("UserInfo did not use the overridden endpoint: got subject %q, expected %q", userInfo.Subject, "override-sub")
+		}
+	})
 }
 
 func setupServer(tok map[string]interface{}, idTokenDesired bool) (*httptest.Server, error) {