invalid_user_info_response after successful login(Java example) Resolved

[a20103111]

In the Java version of demo, invalid_user_info_response appears after successful login.Does the Java version of the demo lack the processing of the userinfo endpoint?
error msg:
[invalid_user_info_response] An error occurred while attempting to retrieve the UserInfo Resource from 'https://stg-id.singpass.gov.sg/userinfo': response contains invalid content type 'application/jwt;charset=utf-8'. The UserInfo Response should return a JSON object (content type 'application/json') that contains a collection of name and value pairs of the claims about the authenticated End-User. Please ensure the UserInfo Uri in UserInfoEndpoint for Client Registration 'singpass' conforms to the UserInfo Endpoint, as defined in OpenID Connect 1.0: 'https://openid.net/specs/openid-connect-core-1_0.html#UserInfo'

[a20103111]

I have solved the problem. The java example missing resolution of userinfo endpoint and need to add these codes：

SecurityConfig.java

@Bean
    public SecurityFilterChain securityFilterChain(
            HttpSecurity http, OAuth2AuthorizationRequestResolver resolver) throws Exception {
        http.authorizeHttpRequests(
                        authorize ->
                                authorize.requestMatchers("/api/user").authenticated().anyRequest().permitAll())
                .logout(logout -> logout.logoutSuccessUrl("/"))
                .exceptionHandling(
                        exception ->
                                exception.defaultAuthenticationEntryPointFor(
                                        new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED),
                                        new AntPathRequestMatcher("/api/**")))
                .oauth2Login(
                        login ->
                                login
                                        .successHandler(
                                                (request, response, authentication) -> response.sendRedirect("/"))
                                        .authorizationEndpoint(
                                                endpoint -> endpoint.authorizationRequestResolver(resolver))
                                        .redirectionEndpoint(endpoint -> endpoint.baseUri("/callback")
                                        ).userInfoEndpoint(userInfo -> userInfo
                                                .oidcUserService(new CustomOidcUserService())
                                        ));
        return http.build();
    }

CustomOidcUserService.java

@Slf4j
public class CustomOidcUserService extends OidcUserService {
    private static String PRIVATE_ENC_D = "private enc key d value";
    @Override
    public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
        String accessTokenValue = userRequest.getAccessToken().getTokenValue();
        String userInfoEndpointUri = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri();

        ResponseEntity<String> response = makeJwtRequest(userInfoEndpointUri, accessTokenValue);
        if (response.getStatusCode() == HttpStatus.OK && response.getBody() != null) {
            try {
                String s = decryptJWE(response.getBody());
                SignedJWT signedJwt = SignedJWT.parse(response.getBody());
                return new DefaultOidcUser(Collections.singleton(new SimpleGrantedAuthority("ROLE_USER")),
                        userRequest.getIdToken(),
                        new OidcUserInfo(signedJwt.getJWTClaimsSet().getClaims()));
            } catch (Exception e) {
                log.error("Failed to parse the UserInfo JWT", e);
            }
        } else {
            throw new OAuth2AuthenticationException("UserInfo request failed or returned an invalid response");
        }
        return null;
    }

    private ResponseEntity<String> makeJwtRequest(String uri, String accessToken) {
        RestTemplate restTemplate = new RestTemplate();
        HttpHeaders headers = new HttpHeaders();
        headers.setBearerAuth(accessToken);
        headers.setContentType(MediaType.APPLICATION_JSON);
        HttpEntity<String> entity = new HttpEntity<>(headers);

        return restTemplate.exchange(uri, HttpMethod.GET, entity, String.class);
    }

    private String decryptJWE(String jweString) throws Exception {

        ECPrivateKey privateKey = loadECPrivateKey(PRIVATE_ENC_D);
        JWEObject jweObject = JWEObject.parse(jweString);
        ECDHDecrypter decrypter = new ECDHDecrypter(privateKey);
        jweObject.decrypt(decrypter);

        return jweObject.getPayload().toString();
    }

    public ECPrivateKey loadECPrivateKey(String dValue) throws Exception {
        byte[] d = Base64.getUrlDecoder().decode(dValue);
        BigInteger dInt = new BigInteger(1, d);

        EllipticCurve curve = Curve.P_256.toECParameterSpec().getCurve();
        ECPoint g = Curve.P_256.toECParameterSpec().getGenerator();
        BigInteger n = Curve.P_256.toECParameterSpec().getOrder();
        int h = Curve.P_256.toECParameterSpec().getCofactor();

        ECParameterSpec ecSpec = new ECParameterSpec(curve, g, n, h);
        ECPrivateKeySpec privateKeySpec = new ECPrivateKeySpec(dInt, ecSpec);

        
        KeyFactory keyFactory = KeyFactory.getInstance("EC");
        return (ECPrivateKey) keyFactory.generatePrivate(privateKeySpec);
    }

}