Add userinfo_endpoint provider metadata to discovery endpoint

[wiliamsouza]

This adds userinfo_endpoint provider metadata to discovery endpoint .well-known/openid-configuration.
and make it editable in config file.

This is used for some smart OpenID connect authentication to provide user data profile or infomations.

https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata

[wiliamsouza]

Maybe add omitempty here?

[rithujohn191]

Not necessary since it is only a "recommended" attribute.

[rithujohn191]

Plz add a comment to describe the UserInfoEndpoint. A link to https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata would also be helpful.

[rithujohn191]

Not necessary since it is only a "recommended" attribute.

[ericchiang]

@rithujohn191 we don't implement this feature #376 Why would we return it in the metadata?

[rithujohn191]

I was under the impression that the claims in ID Token could serve the info needed. Sorry about that. That would make #376 a pre-requisite for this PR.

[wiliamsouza]

This metadata is useful when you already have this endpoint implemented as other service. For now I'm solving this in other place ByteInternet/drf-oidc-auth#20.
To make it clear the use case for userinfo_endpoint is.

                                                  +------------------------------------------+
                                                  |      populate OAuth clients              |
                                                  |      users login and passwords           |
                                                  |                                   +------+------+
                                                  |                                   |             |
                                                  |                                   | sellers api <----------+
                                 2       +--------v-------+                           |             |          |
                          request token  |                |                           +-------------+          |
                        +----------------> openid connect |                                                    |
                        |                |                <------------------------------------------------+   |
                        |                +-----+---^------+              7 validate id_token               |   |
                        |                      |   |                       with oidc provider              |   |
                        |                      |   |                                                       |   |         8
              1         |                      |   |                                                       |   | retrieve userinfo
            authN       |             3        |   |                                                       |   | from users rest api
+--------+  authZ  +----+----+      receive    |   |    5                             +--------------+     |   |
|        |         |         |   token and jwt |   | validate                    jwt  |              +----->   |
| seller +--------->  webapp <-----------------+   | token                     +------> products api |     |   |
|        |         |         |                     |                           |      |              +--------->
+--------+         +----+----+                     |                           |      +--------------+     |   |
                        |                          |                           |                           |   |
                        |                          |                           |                           |   |
                        |                          |                           |                           |   |
                        |                          |                           |      +------------+       |   |
                        |                          |                           | jwt  |            +-------+   |
                        |                          |                           +------> orders api |           |
                        |                          |                           |      |            +-----------+
                        |                          |                           |      +------------+
                        |        4      +----------+--+                        |
                        |       use     |             |           6            |
                        +---------------> api gateway +------------------------>
                          token and jwt |             |
                                        +-------------+
                                    Do access_token offload
                                    bypass id_token only

I'm in doubt what to do with this PR. feel free to close it.

[rithujohn191]

We have been getting a lot of requests to support the user info endpoint but the general idea seems to be that users want this feature so that they can avoid the use of tokens. Which might not be the best practice in terms of security.

I will go ahead and close out this PR for now until we make a final decision regarding the user info endpoint. Thanks again for sending this in.

[wiliamsouza]

In our case we use the same JWT token to get userinfo from endpoint. When you make a decision let me know I would love to help.