From 4b0ea03ed8d61a32ff0a8c5c8c85ab82806a229e Mon Sep 17 00:00:00 2001
From: vampirefrog <vampirefrog@users.noreply.github.com>
Date: Tue, 10 Oct 2023 20:12:46 +0300
Subject: [PATCH 1/2] OpenID: User Claims fix for authorization_code response
 type

---
 .../OpenID/Controller/AuthorizeController.php      | 14 ++++++++++++++
 src/OAuth2/Server.php                              |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/OAuth2/OpenID/Controller/AuthorizeController.php b/src/OAuth2/OpenID/Controller/AuthorizeController.php
index 52e183bb3..d27833d37 100644
--- a/src/OAuth2/OpenID/Controller/AuthorizeController.php
+++ b/src/OAuth2/OpenID/Controller/AuthorizeController.php
@@ -5,6 +5,8 @@
 use OAuth2\Controller\AuthorizeController as BaseAuthorizeController;
 use OAuth2\RequestInterface;
 use OAuth2\ResponseInterface;
+use OAuth2\Storage\ClientInterface;
+use OAuth2\ScopeInterface;
 
 /**
  * @see OAuth2\Controller\AuthorizeControllerInterface
@@ -26,6 +28,17 @@ class AuthorizeController extends BaseAuthorizeController implements AuthorizeCo
      */
     protected $code_challenge_method;
 
+    /**
+     * @var mixed
+     */
+    protected $userClaimsStorage;
+
+    public function __construct(ClientInterface $clientStorage, ClientInterface $userClaimsStorage, array $responseTypes = array(), array $config = array(), ScopeInterface $scopeUtil = null)
+    {
+        parent::__construct($clientStorage, $responseTypes, $config, $scopeUtil);
+        $this->userClaimsStorage = $userClaimsStorage;
+    }
+        
     /**
      * Set not authorized response
      *
@@ -69,6 +82,7 @@ protected function buildAuthorizeParameters($request, $response, $user_id)
 
         // Generate an id token if needed.
         if ($this->needsIdToken($this->getScope()) && $this->getResponseType() == self::RESPONSE_TYPE_AUTHORIZATION_CODE) {
+            $userClaims = $this->userClaimsStorage->getUserClaims($user_id, $params['scope']);
             $params['id_token'] = $this->responseTypes['id_token']->createIdToken($this->getClientId(), $user_id, $this->nonce);
         }
 
diff --git a/src/OAuth2/Server.php b/src/OAuth2/Server.php
index 1fbc6666d..38dd83da5 100644
--- a/src/OAuth2/Server.php
+++ b/src/OAuth2/Server.php
@@ -581,7 +581,7 @@ protected function createDefaultAuthorizeController()
         $config = array_intersect_key($this->config, array_flip(explode(' ', 'allow_implicit enforce_state require_exact_redirect_uri enforce_pkce')));
 
         if ($this->config['use_openid_connect']) {
-            return new OpenIDAuthorizeController($this->storages['client'], $this->responseTypes, $config, $this->getScopeUtil());
+            return new OpenIDAuthorizeController($this->storages['client'], $this->storages['user_claims'], $this->responseTypes, $config, $this->getScopeUtil());
         }
 
         return new AuthorizeController($this->storages['client'], $this->responseTypes, $config, $this->getScopeUtil());

From 9d003b2767c7726476264c8e21d837cd12ef401f Mon Sep 17 00:00:00 2001
From: vampirefrog <vampirefrog@users.noreply.github.com>
Date: Tue, 10 Oct 2023 20:58:47 +0300
Subject: [PATCH 2/2] Update AuthorizeController.php

forgot to pass $userClaims
---
 src/OAuth2/OpenID/Controller/AuthorizeController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/OAuth2/OpenID/Controller/AuthorizeController.php b/src/OAuth2/OpenID/Controller/AuthorizeController.php
index d27833d37..3be804d06 100644
--- a/src/OAuth2/OpenID/Controller/AuthorizeController.php
+++ b/src/OAuth2/OpenID/Controller/AuthorizeController.php
@@ -83,7 +83,7 @@ protected function buildAuthorizeParameters($request, $response, $user_id)
         // Generate an id token if needed.
         if ($this->needsIdToken($this->getScope()) && $this->getResponseType() == self::RESPONSE_TYPE_AUTHORIZATION_CODE) {
             $userClaims = $this->userClaimsStorage->getUserClaims($user_id, $params['scope']);
-            $params['id_token'] = $this->responseTypes['id_token']->createIdToken($this->getClientId(), $user_id, $this->nonce);
+            $params['id_token'] = $this->responseTypes['id_token']->createIdToken($this->getClientId(), $user_id, $this->nonce, $userClaims);
         }
 
         // add the nonce to return with the redirect URI