Improve customizing OIDC UserInfo endpoint

[franzfloresjr]

Expected Behavior
It would be great if the oidcUserInfoEndpointFilter is configurable so that we can provide a custom OidcUserInfoHttpMessageConverter or configure the OidcUserInfoHttpMessageConverter#jsonMessageConverter. In my case, I am using java.time.LocalDate data type in the birthdate claim and need to serialize it to a formatted string (e.g. DateTimeFormatter.ISO_DATE). Hence, I want to provide an object mapper with a configured LocalDateSerializer to the MappingJackson2HttpMessageConverter.

Current Behavior
The default OidcUserInfoHttpMessageConverter#jsonMessageConverter has a value of new MappingJackson2HttpMessageConverter() which has a plain ObjectMapper (Jackson2ObjectMapperBuilder.json().build()). OidcUserInfo claims that has a data type of java.time.LocalDate (in my case birthdate) are written as array of numbers.

Context
I want to serialize java.time.LocalDate to a formatted string. What I did to achieve this is to implement a custom OidcUserInfoEndpontConfigurer, OidcUserInfoEndpointFilter and OidcUserInfoHttpMessageConverter.

public class CustomOidcUserInfoHttpMessageConverter extends AbstractHttpMessageConverter<OidcUserInfo> {
    private final GenericHttpMessageConverter<Object> jsonMessageConverter =
        new MappingJackson2HttpMessageConverter(
            Jackson2ObjectMapperBuilder.json()
                .serializers(new LocalDateSerializer(DateTimeFormatter.ISO_DATE))
                .build()
        );

    ...
}

public class CustomOidcUserInfoEndpointFilter extends OncePerRequestFilter {
    private final HttpMessageConverter<OidcUserInfo> userInfoHttpMessageConverter =
        new CustomOidcUserInfoHttpMessageConverter();
    
    ...
}

public class CustomOidcUserInfoEndpointConfigurer<B extends HttpSecurityBuilder<B>>
    extends AbstractHttpConfigurer<CustomOidcUserInfoEndpointConfigurer<B>, B> {

    @Override
    public void configure(B builder) throws Exception {
        AuthenticationManager authenticationManager = builder.getSharedObject(AuthenticationManager.class);
        ProviderSettings providerSettings = getProviderSettings(builder);

        CustomOidcUserInfoEndpointFilter oidcUserInfoEndpointFilter =
            new CustomOidcUserInfoEndpointFilter(authenticationManager, providerSettings.getOidcUserInfoEndpoint());

        builder.addFilterBefore(oidcUserInfoEndpointFilter, OidcUserInfoEndpointFilter.class);
    }

    ...
}

@Configuration
public class AuthorizationServerConfiguration {
    
    @Bean
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) {

        ...

        http.apply(authorizationServerConfigurer).and()
            .apply(new CustomOidcUserInfoEndpointConfigurer<>());

        return http.build();
    }
}

[Kehrlann]

I'm interested in picking this one up.

[jgrandja]

@franzfloresjr You can now customize the UserInfo response using a custom OidcUserInfoEndpointFilter.setAuthenticationSuccessHandler(AuthenticationSuccessHandler). The custom AuthenticationSuccessHandler can configure a custom OidcUserInfoHttpMessageConverter.setUserInfoParametersConverter(Converter<OidcUserInfo, Map<String, Object>>) to customize the format for any of the claims.